Commit d0aaa57d authored by Larry Finger's avatar Larry Finger Committed by Greg Kroah-Hartman
Browse files

staging: r8192U: Fix check pointer after usage problem 

In routine rtl8192_tx_isr(), pointer skb is dereferenced before it is
checked for NULL. This patch has only been compile-tested, as I do not
have the hardware. This problem was reported at
https://bugzilla.kernel.org/show_bug.cgi?id=109951

.

Fixes: bugzilla.kernel.org: #109951
Reported-by: default avatarYong Shi <brave_shi@163.com>
Signed-off-by: default avatarLarry Finger <Larry.Finger@lwfinger.net>
Cc: Yong Shi <brave_shi@163.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent f06104fb

drivers/staging/rtl8192u/r8192U_core.c

+13 −8
Original line number Original line Diff line number Diff line
@@ -1092,10 +1092,17 @@ static int rtl8192_hard_start_xmit(struct sk_buff *skb, struct net_device *dev) 
static void rtl8192_tx_isr(struct urb *tx_urb)

static void rtl8192_tx_isr(struct urb *tx_urb)

{

{

	struct sk_buff *skb = (struct sk_buff *)tx_urb->context;

	struct sk_buff *skb = (struct sk_buff *)tx_urb->context;

	struct net_device *dev = (struct net_device *)(skb->cb);

	struct net_device *dev;

	struct r8192_priv *priv = NULL;

	struct r8192_priv *priv = NULL;

	cb_desc *tcb_desc = (cb_desc *)(skb->cb + MAX_DEV_ADDR_SIZE);

	cb_desc *tcb_desc;

	u8  queue_index = tcb_desc->queue_index;

	u8  queue_index;



	if (!skb)

		return;



	dev = (struct net_device *)(skb->cb);

	tcb_desc = (cb_desc *)(skb->cb + MAX_DEV_ADDR_SIZE);

	queue_index = tcb_desc->queue_index;





	priv = ieee80211_priv(dev);

	priv = ieee80211_priv(dev);
@@ -1113,11 +1120,9 @@ static void rtl8192_tx_isr(struct urb *tx_urb) 
	}

	}





	/* free skb and tx_urb */

	/* free skb and tx_urb */

	if (skb != NULL) {

	dev_kfree_skb_any(skb);

	dev_kfree_skb_any(skb);

	usb_free_urb(tx_urb);

	usb_free_urb(tx_urb);

	atomic_dec(&priv->tx_pending[queue_index]);

	atomic_dec(&priv->tx_pending[queue_index]);

	}





	/*

	/*

	 * Handle HW Beacon:

	 * Handle HW Beacon: