rtl8192se: Fix BUG caused by failure to check skb allocation

commit d90db4b12bc1b9b8a787ef28550fdb767ee25a49 upstream.

When downloading firmware into the device, the driver fails to check the
return when allocating an skb. When the allocation fails, a BUG can be
generated, as seen in https://bugzilla.redhat.com/show_bug.cgi?id=771656.

Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/fw.c b/drivers/net/wireless/rtlwifi/rtl8192se/fw.c
index 3b5af0113d7f9ad86c5d98515bd733aa95313193..0c77a14a38218e41765d6a53900b90b02ab19e5d 100644 (file)
--- a/drivers/net/wireless/rtlwifi/rtl8192se/fw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192se/fw.c
@@ -196,6 +196,8 @@ static bool _rtl92s_firmware_downloadcode(struct ieee80211_hw *hw,
                /* Allocate skb buffer to contain firmware */
                /* info and tx descriptor info. */
                skb = dev_alloc_skb(frag_length);
+               if (!skb)
+                       return false;
                skb_reserve(skb, extra_descoffset);
                seg_ptr = (u8 *)skb_put(skb, (u32)(frag_length -
                                        extra_descoffset));
@@ -575,6 +577,8 @@ static bool _rtl92s_firmware_set_h2c_cmd(struct ieee80211_hw *hw, u8 h2c_cmd,
 
        len = _rtl92s_get_h2c_cmdlen(MAX_TRANSMIT_BUFFER_SIZE, 1, &cmd_len);
        skb = dev_alloc_skb(len);
+       if (!skb)
+               return false;
        cb_desc = (struct rtl_tcb_desc *)(skb->cb);
        cb_desc->queue_index = TXCMD_QUEUE;
        cb_desc->cmd_or_init = DESC_PACKET_TYPE_NORMAL;