summaryrefslogtreecommitdiffstats
path: root/net/wireless/nl80211.c
diff options
context:
space:
mode:
authorJohannes Berg <johannes.berg@intel.com>2016-09-14 09:55:57 +0200
committerJohannes Berg <johannes.berg@intel.com>2016-09-15 16:46:17 +0200
commit76e1fb4b5532a9df9eb14cfe002412c7617c4ad0 (patch)
treeab1f7c13aa42ae797597020d2888abe107542b67 /net/wireless/nl80211.c
parent58bd7f1158ac7543ccdcddc7f4ecd7db458e6d0b (diff)
downloadlinux-76e1fb4b5532a9df9eb14cfe002412c7617c4ad0.tar.bz2
nl80211: always check nla_nest_start() return value
If the message got full during nla_nest_start(), it can return NULL. None of the cases here seem like that can really happen, but check the return value nonetheless. Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Diffstat (limited to 'net/wireless/nl80211.c')
-rw-r--r--net/wireless/nl80211.c11
1 files changed, 11 insertions, 0 deletions
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index f2a77c3daa59..60c8a7429d33 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -8022,6 +8022,8 @@ __cfg80211_alloc_vendor_skb(struct cfg80211_registered_device *rdev,
}
data = nla_nest_start(skb, attr);
+ if (!data)
+ goto nla_put_failure;
((void **)skb->cb)[0] = rdev;
((void **)skb->cb)[1] = hdr;
@@ -9458,8 +9460,14 @@ static int nl80211_send_wowlan_nd(struct sk_buff *msg,
if (req->n_match_sets) {
matches = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_MATCH);
+ if (!matches)
+ return -ENOBUFS;
+
for (i = 0; i < req->n_match_sets; i++) {
match = nla_nest_start(msg, i);
+ if (!match)
+ return -ENOBUFS;
+
nla_put(msg, NL80211_SCHED_SCAN_MATCH_ATTR_SSID,
req->match_sets[i].ssid.ssid_len,
req->match_sets[i].ssid.ssid);
@@ -9474,6 +9482,9 @@ static int nl80211_send_wowlan_nd(struct sk_buff *msg,
for (i = 0; i < req->n_scan_plans; i++) {
scan_plan = nla_nest_start(msg, i + 1);
+ if (!scan_plan)
+ return -ENOBUFS;
+
if (!scan_plan ||
nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_INTERVAL,
req->scan_plans[i].interval) ||