This is a note to let you know that I've just added the patch titled
rtlwifi: rtl8192c_common: rtl8192de: Check for allocation failures
to the 3.3-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
rtlwifi-rtl8192c_common-rtl8192de-check-for-allocation-failures.patch
and it can be found in the queue-3.3 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <[email protected]> know about it.
>From 76a92be537f1c8c259e393632301446257ca3ea9 Mon Sep 17 00:00:00 2001
From: Larry Finger <[email protected]>
Date: Sat, 7 Jan 2012 20:46:40 -0600
Subject: rtlwifi: rtl8192c_common: rtl8192de: Check for allocation failures
From: Larry Finger <[email protected]>
commit 76a92be537f1c8c259e393632301446257ca3ea9 upstream.
In https://bugzilla.redhat.com/show_bug.cgi?id=771656, a kernel bug was
triggered due to a failed skb allocation that was not checked. This event
lead to an audit of all memory allocations in the complete rtlwifi family
of drivers. This patch fixes the rest.
Signed-off-by: Larry Finger <[email protected]>
Signed-off-by: John W. Linville <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
drivers/net/wireless/rtlwifi/pci.c | 2 ++
drivers/net/wireless/rtlwifi/rtl8192c/fw_common.c | 2 ++
drivers/net/wireless/rtlwifi/rtl8192de/fw.c | 14 +++++++++-----
drivers/net/wireless/rtlwifi/usb.c | 12 +++++++-----
4 files changed, 20 insertions(+), 10 deletions(-)
--- a/drivers/net/wireless/rtlwifi/pci.c
+++ b/drivers/net/wireless/rtlwifi/pci.c
@@ -657,6 +657,8 @@ static void _rtl_receive_one(struct ieee
return;
uskb = dev_alloc_skb(skb->len + 128);
+ if (!uskb)
+ return; /* exit if allocation failed */
memcpy(IEEE80211_SKB_RXCB(uskb), &rx_status, sizeof(rx_status));
pdata = (u8 *)skb_put(uskb, skb->len);
memcpy(pdata, skb->data, skb->len);
--- a/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192c/fw_common.c
@@ -788,6 +788,8 @@ void rtl92c_set_fw_rsvdpagepkt(struct ie
skb = dev_alloc_skb(totalpacketlen);
+ if (!skb)
+ return;
memcpy((u8 *) skb_put(skb, totalpacketlen),
&reserved_page_packet, totalpacketlen);
--- a/drivers/net/wireless/rtlwifi/rtl8192de/fw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192de/fw.c
@@ -763,12 +763,16 @@ void rtl92d_set_fw_rsvdpagepkt(struct ie
"rtl92d_set_fw_rsvdpagepkt(): HW_VAR_SET_TX_CMD: ALL\n",
u1RsvdPageLoc, 3);
skb = dev_alloc_skb(totalpacketlen);
- memcpy((u8 *) skb_put(skb, totalpacketlen), &reserved_page_packet,
- totalpacketlen);
- rtstatus = _rtl92d_cmd_send_packet(hw, skb);
+ if (!skb) {
+ dlok = false;
+ } else {
+ memcpy((u8 *) skb_put(skb, totalpacketlen),
+ &reserved_page_packet, totalpacketlen);
+ rtstatus = _rtl92d_cmd_send_packet(hw, skb);
- if (rtstatus)
- dlok = true;
+ if (rtstatus)
+ dlok = true;
+ }
if (dlok) {
RT_TRACE(rtlpriv, COMP_POWER, DBG_LOUD,
("Set RSVD page location to Fw.\n"));
--- a/drivers/net/wireless/rtlwifi/usb.c
+++ b/drivers/net/wireless/rtlwifi/usb.c
@@ -520,12 +520,14 @@ static void _rtl_usb_rx_process_noagg(st
u8 *pdata;
uskb = dev_alloc_skb(skb->len + 128);
- memcpy(IEEE80211_SKB_RXCB(uskb), &rx_status,
- sizeof(rx_status));
- pdata = (u8 *)skb_put(uskb, skb->len);
- memcpy(pdata, skb->data, skb->len);
+ if (uskb) { /* drop packet on allocation failure */
+ memcpy(IEEE80211_SKB_RXCB(uskb), &rx_status,
+ sizeof(rx_status));
+ pdata = (u8 *)skb_put(uskb, skb->len);
+ memcpy(pdata, skb->data, skb->len);
+ ieee80211_rx_irqsafe(hw, uskb);
+ }
dev_kfree_skb_any(skb);
- ieee80211_rx_irqsafe(hw, uskb);
} else {
dev_kfree_skb_any(skb);
}
Patches currently in stable-queue which might be from [email protected]
are
queue-3.3/staging-r8712u-fix-regression-introduced-by-commit-a5ee652.patch
queue-3.3/rtlwifi-rtl8192c_common-rtl8192de-check-for-allocation-failures.patch
queue-3.3/rtlwifi-rtl8192ce-fix-loss-of-receive-performance.patch
queue-3.3/rtlwifi-rtl8192c-prevent-sleeping-from-invalid-context-in-rtl8192cu.patch
queue-3.3/staging-r8712u-fix-regression-in-signal-level-after-commit-c6dc001.patch
queue-3.3/rtlwifi-handle-previous-allocation-failures-when-freeing-device-memory.patch
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
