From 5ca136a0cb96aabcb3c2158fb958677d55915f93 Mon Sep 17 00:00:00 2001 From: Larry Finger Date: Tue, 28 Aug 2012 11:59:04 -0500 Subject: [PATCH] staging: r8712u: Fix allocations not checked for failure The driver has a dev_alloc_skb() and an skb_clone() call that are not checked for failure. Signed-off-by: Larry Finger Signed-off-by: Greg Kroah-Hartman --- drivers/staging/rtl8712/rtl8712_recv.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/staging/rtl8712/rtl8712_recv.c b/drivers/staging/rtl8712/rtl8712_recv.c index 8e82ce2fee3..4cd297aed78 100644 --- a/drivers/staging/rtl8712/rtl8712_recv.c +++ b/drivers/staging/rtl8712/rtl8712_recv.c @@ -374,6 +374,8 @@ static int amsdu_to_msdu(struct _adapter *padapter, union recv_frame *prframe) a_len -= ETH_HLEN; /* Allocate new skb for releasing to upper layer */ sub_skb = dev_alloc_skb(nSubframe_Length + 12); + if (!sub_skb) + break; skb_reserve(sub_skb, 12); data_ptr = (u8 *)skb_put(sub_skb, nSubframe_Length); memcpy(data_ptr, pdata, nSubframe_Length); @@ -1094,6 +1096,8 @@ static int recvbuf2recvframe(struct _adapter *padapter, struct sk_buff *pskb) precvframe->u.hdr.rx_end = pkt_copy->data + alloc_sz; } else { precvframe->u.hdr.pkt = skb_clone(pskb, GFP_ATOMIC); + if (!precvframe->u.hdr.pkt) + return _FAIL; precvframe->u.hdr.rx_head = pbuf; precvframe->u.hdr.rx_data = pbuf; precvframe->u.hdr.rx_tail = pbuf;