hollalinux
/
linux-sg2042
mirror of https://github.com/sophgo/linux-riscv.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

staging: r8192U: Fix check pointer after usage problem 

In routine rtl8192_tx_isr(), pointer skb is dereferenced before it is
checked for NULL. This patch has only been compile-tested, as I do not
have the hardware. This problem was reported at
https://bugzilla.kernel.org/show_bug.cgi?id=109951.

Fixes: bugzilla.kernel.org: #109951
Reported-by: Yong Shi <brave_shi@163.com>
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Cc: Yong Shi <brave_shi@163.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Larry Finger 2016-01-04 20:30:58 -06:00 committed by Greg Kroah-Hartman
parent f06104fb32
commit d0aaa57df2
1 changed files with 13 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
drivers/staging/rtl8192u/r8192U_core.c
View File

@ -1092,10 +1092,17 @@ static int rtl8192_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
static void rtl8192_tx_isr(struct urb *tx_urb) static void rtl8192_tx_isr(struct urb *tx_urb)
{ {
struct sk_buff *skb = (struct sk_buff *)tx_urb->context; struct sk_buff *skb = (struct sk_buff *)tx_urb->context;
struct net_device *dev = (struct net_device *)(skb->cb); struct net_device *dev;
struct r8192_priv *priv = NULL; struct r8192_priv *priv = NULL;
cb_desc *tcb_desc = (cb_desc *)(skb->cb + MAX_DEV_ADDR_SIZE); cb_desc *tcb_desc;
u8 queue_index = tcb_desc->queue_index; u8 queue_index;
if (!skb)
return;
dev = (struct net_device *)(skb->cb);
tcb_desc = (cb_desc *)(skb->cb + MAX_DEV_ADDR_SIZE);
queue_index = tcb_desc->queue_index;
priv = ieee80211_priv(dev); priv = ieee80211_priv(dev);
@ -1113,11 +1120,9 @@ static void rtl8192_tx_isr(struct urb *tx_urb)
} }
/* free skb and tx_urb */ /* free skb and tx_urb */
if (skb != NULL) { dev_kfree_skb_any(skb);
dev_kfree_skb_any(skb); usb_free_urb(tx_urb);
usb_free_urb(tx_urb); atomic_dec(&priv->tx_pending[queue_index]);
atomic_dec(&priv->tx_pending[queue_index]);
}
/* /*
* Handle HW Beacon: * Handle HW Beacon: