tty: ipwireless: fix possible NULL dereference

The function alloc_ctrl_packet() can fail and return NULL. Incase it
fails print an error message and exit.

Signed-off-by: Sudip Mukherjee <sudip.mukherjee@codethink.co.uk>
Reviewed-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/tty/ipwireless/hardware.c b/drivers/tty/ipwireless/hardware.c
index ad7031a..df0204b 100644 (file)
--- a/drivers/tty/ipwireless/hardware.c
+++ b/drivers/tty/ipwireless/hardware.c
@@ -1572,6 +1572,11 @@ static void handle_received_SETUP_packet(struct ipw_hardware *hw,
                                        sizeof(struct ipw_setup_reboot_msg_ack),
                                        ADDR_SETUP_PROT, TL_PROTOCOLID_SETUP,
                                        TL_SETUP_SIGNO_REBOOT_MSG_ACK);
+                       if (!packet) {
+                               pr_err(IPWIRELESS_PCCARD_NAME
+                                      ": Not enough memory to send reboot packet");
+                               break;
+                       }
                        packet->header.length =
                                sizeof(struct TlSetupRebootMsgAck);
                        send_packet(hw, PRIO_SETUP, &packet->header);