lkml.org 
[lkml]   [2013]   [Dec]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH RESEND] net: wirelesse: wcn36xx: pull allocation outside of critical section
    Date
    Commit [3469adb3: fix potential NULL pointer dereference] introduced
    a check of msg_ind allocation, but omitted allocation of msg_ind->msg.
    Moreover, it introduced two if statements, which looked a bit clunky.

    This commit moves allocation code outside of the critical section so
    there's no need to dance around mutex_unlock, and adds the missing
    allocation check.

    Signed-off-by: Michal Nazarewicz <mina86@mina86.com>
    ---
    drivers/net/wireless/ath/wcn36xx/smd.c | 32 +++++++++++++++++++-------------
    1 file changed, 19 insertions(+), 13 deletions(-)

    On Wed, Dec 11 2013, John W. Linville wrote:
    > Missing Signed-off-by...

    Sorry about that.

    diff --git a/drivers/net/wireless/ath/wcn36xx/smd.c b/drivers/net/wireless/ath/wcn36xx/smd.c
    index 8f37562..750626b 100644
    --- a/drivers/net/wireless/ath/wcn36xx/smd.c
    +++ b/drivers/net/wireless/ath/wcn36xx/smd.c
    @@ -2060,22 +2060,28 @@ static void wcn36xx_smd_rsp_process(struct wcn36xx *wcn, void *buf, size_t len)
    case WCN36XX_HAL_OTA_TX_COMPL_IND:
    case WCN36XX_HAL_MISSED_BEACON_IND:
    case WCN36XX_HAL_DELETE_STA_CONTEXT_IND:
    - mutex_lock(&wcn->hal_ind_mutex);
    msg_ind = kmalloc(sizeof(*msg_ind), GFP_KERNEL);
    - if (msg_ind) {
    - msg_ind->msg_len = len;
    - msg_ind->msg = kmalloc(len, GFP_KERNEL);
    - memcpy(msg_ind->msg, buf, len);
    - list_add_tail(&msg_ind->list, &wcn->hal_ind_queue);
    - queue_work(wcn->hal_ind_wq, &wcn->hal_ind_work);
    - wcn36xx_dbg(WCN36XX_DBG_HAL, "indication arrived\n");
    + if (!msg_ind)
    + goto nomem;
    + msg_ind->msg_len = len;
    + msg_ind->msg = kmalloc(len, GFP_KERNEL);
    + if (!msg_ind->msg) {
    + kfree(msg_ind);
    +nomem:
    + /*
    + * FIXME: Do something smarter then just
    + * printing an error.
    + */
    + wcn36xx_err("Run out of memory while handling SMD_EVENT (%d)\n",
    + msg_header->msg_type);
    + break;
    }
    + memcpy(msg_ind->msg, buf, len);
    + mutex_lock(&wcn->hal_ind_mutex);
    + list_add_tail(&msg_ind->list, &wcn->hal_ind_queue);
    + queue_work(wcn->hal_ind_wq, &wcn->hal_ind_work);
    mutex_unlock(&wcn->hal_ind_mutex);
    - if (msg_ind)
    - break;
    - /* FIXME: Do something smarter then just printing an error. */
    - wcn36xx_err("Run out of memory while handling SMD_EVENT (%d)\n",
    - msg_header->msg_type);
    + wcn36xx_dbg(WCN36XX_DBG_HAL, "indication arrived\n");
    break;
    default:
    wcn36xx_err("SMD_EVENT (%d) not supported\n",
    --
    1.8.4


    \
     
     \ /
      Last update: 2013-12-11 18:01    [W:3.624 / U:0.004 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site