Commit 980cd426 authored by Minu Jin's avatar Minu Jin Committed by Greg Kroah-Hartman
Browse files

staging: rtl8723bs: replace rtw_zmalloc() with kzalloc() 



Replace the wrapper function rtw_zmalloc() with standard kzalloc().
Use kzalloc() for rtw_malloc() calls that were followed by manual
zero initialization.

About GFP Flags:
- GFP_ATOMIC is used for allocations in atomic contexts such as
  spinlock-protected sections, tasklets, and timer handlers.
- GFP_KERNEL is used for process contexts where sleeping is allowed.

Additionally, use array_size() and size_add() to prevent potential
integer overflows during allocation size calculation.

Signed-off-by: default avatarMinu Jin <s9430939@naver.com>
Reviewed-by: default avatarAndy Shevchenko <andriy.shevchenko@intel.com>
Link: https://patch.msgid.link/20260204131347.3515949-4-s9430939@naver.com


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 9577f3b3

drivers/staging/rtl8723bs/core/rtw_ap.c

+4 −4
Original line number Diff line number Diff line
@@ -1229,13 +1229,13 @@ u8 rtw_ap_set_pairwise_key(struct adapter *padapter, struct sta_info *psta) 
	struct cmd_priv *pcmdpriv = &padapter->cmdpriv;

	u8 res = _SUCCESS;



	ph2c = rtw_zmalloc(sizeof(struct cmd_obj));

	ph2c = kzalloc(sizeof(*ph2c), GFP_KERNEL);

	if (!ph2c) {

		res = _FAIL;

		goto exit;

	}



	psetstakey_para = rtw_zmalloc(sizeof(struct set_stakey_parm));

	psetstakey_para = kzalloc(sizeof(*psetstakey_para), GFP_KERNEL);

	if (!psetstakey_para) {

		kfree(ph2c);

		res = _FAIL;
@@ -1269,12 +1269,12 @@ static int rtw_ap_set_key(struct adapter *padapter, 
	struct cmd_priv *pcmdpriv = &padapter->cmdpriv;

	int res = _SUCCESS;



	pcmd = rtw_zmalloc(sizeof(struct cmd_obj));

	pcmd = kzalloc(sizeof(*pcmd), GFP_KERNEL);

	if (!pcmd) {

		res = _FAIL;

		goto exit;

	}

	psetkeyparm = rtw_zmalloc(sizeof(struct setkey_parm));

	psetkeyparm = kzalloc(sizeof(*psetkeyparm), GFP_KERNEL);

	if (!psetkeyparm) {

		kfree(pcmd);

		res = _FAIL;

drivers/staging/rtl8723bs/core/rtw_cmd.c

+39 −42
Original line number Diff line number Diff line
@@ -171,15 +171,13 @@ int rtw_init_cmd_priv(struct cmd_priv *pcmdpriv) 


	pcmdpriv->cmd_seq = 1;



	pcmdpriv->cmd_allocated_buf = rtw_zmalloc(MAX_CMDSZ + CMDBUFF_ALIGN_SZ);



	pcmdpriv->cmd_allocated_buf = kzalloc(MAX_CMDSZ + CMDBUFF_ALIGN_SZ, GFP_ATOMIC);

	if (!pcmdpriv->cmd_allocated_buf)

		return -ENOMEM;



	pcmdpriv->cmd_buf = PTR_ALIGN(pcmdpriv->cmd_allocated_buf, CMDBUFF_ALIGN_SZ);



	pcmdpriv->rsp_allocated_buf = rtw_zmalloc(MAX_RSPSZ + 4);



	pcmdpriv->rsp_allocated_buf = kzalloc(MAX_RSPSZ + 4, GFP_ATOMIC);

	if (!pcmdpriv->rsp_allocated_buf) {

		kfree(pcmdpriv->cmd_allocated_buf);

		return -ENOMEM;
@@ -535,11 +533,11 @@ u8 rtw_sitesurvey_cmd(struct adapter *padapter, struct ndis_802_11_ssid *ssid, 
	if (check_fwstate(pmlmepriv, _FW_LINKED))

		rtw_lps_ctrl_wk_cmd(padapter, LPS_CTRL_SCAN, 1);



	ph2c = rtw_zmalloc(sizeof(struct cmd_obj));

	ph2c = kzalloc(sizeof(*ph2c), GFP_ATOMIC);

	if (!ph2c)

		return _FAIL;



	psurveyPara = rtw_zmalloc(sizeof(struct sitesurvey_parm));

	psurveyPara = kzalloc(sizeof(*psurveyPara), GFP_ATOMIC);

	if (!psurveyPara) {

		kfree(ph2c);

		return _FAIL;
@@ -603,7 +601,7 @@ u8 rtw_createbss_cmd(struct adapter *padapter) 
	struct wlan_bssid_ex *pdev_network = &padapter->registrypriv.dev_network;

	u8 res = _SUCCESS;



	pcmd = rtw_zmalloc(sizeof(struct cmd_obj));

	pcmd = kzalloc(sizeof(*pcmd), GFP_ATOMIC);

	if (!pcmd) {

		res = _FAIL;

		goto exit;
@@ -636,7 +634,7 @@ int rtw_startbss_cmd(struct adapter *padapter, int flags) 
		start_bss_network(padapter);

	} else {

		/* need enqueue, prepare cmd_obj and enqueue */

		pcmd = rtw_zmalloc(sizeof(struct cmd_obj));

		pcmd = kzalloc(sizeof(*pcmd), GFP_KERNEL);

		if (!pcmd) {

			res = _FAIL;

			goto exit;
@@ -688,7 +686,7 @@ u8 rtw_joinbss_cmd(struct adapter *padapter, struct wlan_network *pnetwork) 
	u32 tmp_len;

	u8 *ptmp = NULL;



	pcmd = rtw_zmalloc(sizeof(struct cmd_obj));

	pcmd = kzalloc(sizeof(*pcmd), GFP_KERNEL);

	if (!pcmd) {

		res = _FAIL;

		goto exit;
@@ -797,7 +795,7 @@ u8 rtw_disassoc_cmd(struct adapter *padapter, u32 deauth_timeout_ms, bool enqueu 
	u8 res = _SUCCESS;



	/* prepare cmd parameter */

	param = rtw_zmalloc(sizeof(*param));

	param = kzalloc(sizeof(*param), GFP_KERNEL);

	if (!param) {

		res = _FAIL;

		goto exit;
@@ -806,7 +804,7 @@ u8 rtw_disassoc_cmd(struct adapter *padapter, u32 deauth_timeout_ms, bool enqueu 


	if (enqueue) {

		/* need enqueue, prepare cmd_obj and enqueue */

		cmdobj = rtw_zmalloc(sizeof(*cmdobj));

		cmdobj = kzalloc(sizeof(*cmdobj), GFP_KERNEL);

		if (!cmdobj) {

			res = _FAIL;

			kfree(param);
@@ -833,8 +831,7 @@ u8 rtw_setopmode_cmd(struct adapter *padapter, enum ndis_802_11_network_infrast 
	struct	cmd_priv   *pcmdpriv = &padapter->cmdpriv;

	u8 res = _SUCCESS;



	psetop = rtw_zmalloc(sizeof(struct setopmode_parm));



	psetop = kzalloc(sizeof(*psetop), GFP_KERNEL);

	if (!psetop) {

		res = _FAIL;

		goto exit;
@@ -842,7 +839,7 @@ u8 rtw_setopmode_cmd(struct adapter *padapter, enum ndis_802_11_network_infrast 
	psetop->mode = (u8)networktype;



	if (enqueue) {

		ph2c = rtw_zmalloc(sizeof(struct cmd_obj));

		ph2c = kzalloc(sizeof(*ph2c), GFP_KERNEL);

		if (!ph2c) {

			kfree(psetop);

			res = _FAIL;
@@ -869,7 +866,7 @@ u8 rtw_setstakey_cmd(struct adapter *padapter, struct sta_info *sta, u8 unicast_ 
	struct security_priv *psecuritypriv = &padapter->securitypriv;

	u8 res = _SUCCESS;



	psetstakey_para = rtw_zmalloc(sizeof(struct set_stakey_parm));

	psetstakey_para = kzalloc(sizeof(*psetstakey_para), GFP_KERNEL);

	if (!psetstakey_para) {

		res = _FAIL;

		goto exit;
@@ -891,14 +888,14 @@ u8 rtw_setstakey_cmd(struct adapter *padapter, struct sta_info *sta, u8 unicast_ 
	padapter->securitypriv.busetkipkey = true;



	if (enqueue) {

		ph2c = rtw_zmalloc(sizeof(struct cmd_obj));

		ph2c = kzalloc(sizeof(*ph2c), GFP_KERNEL);

		if (!ph2c) {

			kfree(psetstakey_para);

			res = _FAIL;

			goto exit;

		}



		psetstakey_rsp = rtw_zmalloc(sizeof(struct set_stakey_rsp));

		psetstakey_rsp = kzalloc(sizeof(*psetstakey_rsp), GFP_KERNEL);

		if (!psetstakey_rsp) {

			kfree(ph2c);

			kfree(psetstakey_para);
@@ -936,20 +933,20 @@ u8 rtw_clearstakey_cmd(struct adapter *padapter, struct sta_info *sta, u8 enqueu 
			rtw_camid_free(padapter, cam_id);

		}

	} else {

		ph2c = rtw_zmalloc(sizeof(struct cmd_obj));

		ph2c = kzalloc(sizeof(*ph2c), GFP_KERNEL);

		if (!ph2c) {

			res = _FAIL;

			goto exit;

		}



		psetstakey_para = rtw_zmalloc(sizeof(struct set_stakey_parm));

		psetstakey_para = kzalloc(sizeof(*psetstakey_para), GFP_KERNEL);

		if (!psetstakey_para) {

			kfree(ph2c);

			res = _FAIL;

			goto exit;

		}



		psetstakey_rsp = rtw_zmalloc(sizeof(struct set_stakey_rsp));

		psetstakey_rsp = kzalloc(sizeof(*psetstakey_rsp), GFP_KERNEL);

		if (!psetstakey_rsp) {

			kfree(ph2c);

			kfree(psetstakey_para);
@@ -979,13 +976,13 @@ u8 rtw_addbareq_cmd(struct adapter *padapter, u8 tid, u8 *addr) 


	u8 res = _SUCCESS;



	ph2c = rtw_zmalloc(sizeof(struct cmd_obj));

	ph2c = kzalloc(sizeof(*ph2c), GFP_ATOMIC);

	if (!ph2c) {

		res = _FAIL;

		goto exit;

	}



	paddbareq_parm = rtw_zmalloc(sizeof(struct addBaReq_parm));

	paddbareq_parm = kzalloc(sizeof(*paddbareq_parm), GFP_ATOMIC);

	if (!paddbareq_parm) {

		kfree(ph2c);

		res = _FAIL;
@@ -1012,13 +1009,13 @@ u8 rtw_reset_securitypriv_cmd(struct adapter *padapter) 
	struct cmd_priv *pcmdpriv = &padapter->cmdpriv;

	u8 res = _SUCCESS;



	ph2c = rtw_zmalloc(sizeof(struct cmd_obj));

	ph2c = kzalloc(sizeof(*ph2c), GFP_ATOMIC);

	if (!ph2c) {

		res = _FAIL;

		goto exit;

	}



	pdrvextra_cmd_parm = rtw_zmalloc(sizeof(struct drvextra_cmd_parm));

	pdrvextra_cmd_parm = kzalloc(sizeof(*pdrvextra_cmd_parm), GFP_ATOMIC);

	if (!pdrvextra_cmd_parm) {

		kfree(ph2c);

		res = _FAIL;
@@ -1045,13 +1042,13 @@ u8 rtw_free_assoc_resources_cmd(struct adapter *padapter) 
	struct cmd_priv *pcmdpriv = &padapter->cmdpriv;

	u8 res = _SUCCESS;



	ph2c = rtw_zmalloc(sizeof(struct cmd_obj));

	ph2c = kzalloc(sizeof(*ph2c), GFP_ATOMIC);

	if (!ph2c) {

		res = _FAIL;

		goto exit;

	}



	pdrvextra_cmd_parm = rtw_zmalloc(sizeof(struct drvextra_cmd_parm));

	pdrvextra_cmd_parm = kzalloc(sizeof(*pdrvextra_cmd_parm), GFP_ATOMIC);

	if (!pdrvextra_cmd_parm) {

		kfree(ph2c);

		res = _FAIL;
@@ -1079,13 +1076,13 @@ u8 rtw_dynamic_chk_wk_cmd(struct adapter *padapter) 
	u8 res = _SUCCESS;



	/* only  primary padapter does this cmd */

	ph2c = rtw_zmalloc(sizeof(struct cmd_obj));

	ph2c = kzalloc(sizeof(*ph2c), GFP_ATOMIC);

	if (!ph2c) {

		res = _FAIL;

		goto exit;

	}



	pdrvextra_cmd_parm = rtw_zmalloc(sizeof(struct drvextra_cmd_parm));

	pdrvextra_cmd_parm = kzalloc(sizeof(*pdrvextra_cmd_parm), GFP_ATOMIC);

	if (!pdrvextra_cmd_parm) {

		kfree(ph2c);

		res = _FAIL;
@@ -1319,13 +1316,13 @@ u8 rtw_lps_ctrl_wk_cmd(struct adapter *padapter, u8 lps_ctrl_type, u8 enqueue) 
	u8 res = _SUCCESS;



	if (enqueue) {

		ph2c = rtw_zmalloc(sizeof(struct cmd_obj));

		ph2c = kzalloc(sizeof(*ph2c), GFP_ATOMIC);

		if (!ph2c) {

			res = _FAIL;

			goto exit;

		}



		pdrvextra_cmd_parm = rtw_zmalloc(sizeof(struct drvextra_cmd_parm));

		pdrvextra_cmd_parm = kzalloc(sizeof(*pdrvextra_cmd_parm), GFP_ATOMIC);

		if (!pdrvextra_cmd_parm) {

			kfree(ph2c);

			res = _FAIL;
@@ -1360,13 +1357,13 @@ u8 rtw_dm_in_lps_wk_cmd(struct adapter *padapter) 
	struct cmd_priv *pcmdpriv = &padapter->cmdpriv;

	u8 res = _SUCCESS;



	ph2c = rtw_zmalloc(sizeof(struct cmd_obj));

	ph2c = kzalloc(sizeof(*ph2c), GFP_ATOMIC);

	if (!ph2c) {

		res = _FAIL;

		goto exit;

	}



	pdrvextra_cmd_parm = rtw_zmalloc(sizeof(struct drvextra_cmd_parm));

	pdrvextra_cmd_parm = kzalloc(sizeof(*pdrvextra_cmd_parm), GFP_ATOMIC);

	if (!pdrvextra_cmd_parm) {

		kfree(ph2c);

		res = _FAIL;
@@ -1422,13 +1419,13 @@ u8 rtw_dm_ra_mask_wk_cmd(struct adapter *padapter, u8 *psta) 
	struct cmd_priv *pcmdpriv = &padapter->cmdpriv;

	u8 res = _SUCCESS;



	ph2c = rtw_zmalloc(sizeof(struct cmd_obj));

	ph2c = kzalloc(sizeof(*ph2c), GFP_ATOMIC);

	if (!ph2c) {

		res = _FAIL;

		goto exit;

	}



	pdrvextra_cmd_parm = rtw_zmalloc(sizeof(struct drvextra_cmd_parm));

	pdrvextra_cmd_parm = kzalloc(sizeof(*pdrvextra_cmd_parm), GFP_ATOMIC);

	if (!pdrvextra_cmd_parm) {

		kfree(ph2c);

		res = _FAIL;
@@ -1456,13 +1453,13 @@ u8 rtw_ps_cmd(struct adapter *padapter) 
	struct cmd_priv *pcmdpriv = &padapter->cmdpriv;

	u8 res = _SUCCESS;



	ppscmd = rtw_zmalloc(sizeof(struct cmd_obj));

	ppscmd = kzalloc(sizeof(*ppscmd), GFP_ATOMIC);

	if (!ppscmd) {

		res = _FAIL;

		goto exit;

	}



	pdrvextra_cmd_parm = rtw_zmalloc(sizeof(struct drvextra_cmd_parm));

	pdrvextra_cmd_parm = kzalloc(sizeof(*pdrvextra_cmd_parm), GFP_ATOMIC);

	if (!pdrvextra_cmd_parm) {

		kfree(ppscmd);

		res = _FAIL;
@@ -1526,13 +1523,13 @@ u8 rtw_chk_hi_queue_cmd(struct adapter *padapter) 
	struct cmd_priv *pcmdpriv = &padapter->cmdpriv;

	u8 res = _SUCCESS;



	ph2c = rtw_zmalloc(sizeof(struct cmd_obj));

	ph2c = kzalloc(sizeof(*ph2c), GFP_ATOMIC);

	if (!ph2c) {

		res = _FAIL;

		goto exit;

	}



	pdrvextra_cmd_parm = rtw_zmalloc(sizeof(struct drvextra_cmd_parm));

	pdrvextra_cmd_parm = kzalloc(sizeof(*pdrvextra_cmd_parm), GFP_ATOMIC);

	if (!pdrvextra_cmd_parm) {

		kfree(ph2c);

		res = _FAIL;
@@ -1618,13 +1615,13 @@ u8 rtw_c2h_packet_wk_cmd(struct adapter *padapter, u8 *pbuf, u16 length) 
	struct cmd_priv *pcmdpriv = &padapter->cmdpriv;

	u8 res = _SUCCESS;



	ph2c = rtw_zmalloc(sizeof(struct cmd_obj));

	ph2c = kzalloc(sizeof(*ph2c), GFP_ATOMIC);

	if (!ph2c) {

		res = _FAIL;

		goto exit;

	}



	pdrvextra_cmd_parm = rtw_zmalloc(sizeof(struct drvextra_cmd_parm));

	pdrvextra_cmd_parm = kzalloc(sizeof(*pdrvextra_cmd_parm), GFP_ATOMIC);

	if (!pdrvextra_cmd_parm) {

		kfree(ph2c);

		res = _FAIL;
@@ -1653,13 +1650,13 @@ u8 rtw_c2h_wk_cmd(struct adapter *padapter, u8 *c2h_evt) 
	struct cmd_priv *pcmdpriv = &padapter->cmdpriv;

	u8 res = _SUCCESS;



	ph2c = rtw_zmalloc(sizeof(struct cmd_obj));

	ph2c = kzalloc(sizeof(*ph2c), GFP_KERNEL);

	if (!ph2c) {

		res = _FAIL;

		goto exit;

	}



	pdrvextra_cmd_parm = rtw_zmalloc(sizeof(struct drvextra_cmd_parm));

	pdrvextra_cmd_parm = kzalloc(sizeof(*pdrvextra_cmd_parm), GFP_KERNEL);

	if (!pdrvextra_cmd_parm) {

		kfree(ph2c);

		res = _FAIL;

drivers/staging/rtl8723bs/core/rtw_mlme.c

+5 −5
Original line number Diff line number Diff line
@@ -1875,13 +1875,13 @@ signed int rtw_set_auth(struct adapter *adapter, struct security_priv *psecurity 
	struct	cmd_priv *pcmdpriv = &adapter->cmdpriv;

	signed int		res = _SUCCESS;



	pcmd = rtw_zmalloc(sizeof(struct cmd_obj));

	pcmd = kzalloc(sizeof(*pcmd), GFP_KERNEL);

	if (!pcmd) {

		res = _FAIL;  /* try again */

		goto exit;

	}



	psetauthparm = rtw_zmalloc(sizeof(struct setauth_parm));

	psetauthparm = kzalloc(sizeof(*psetauthparm), GFP_KERNEL);

	if (!psetauthparm) {

		kfree(pcmd);

		res = _FAIL;
@@ -1912,7 +1912,7 @@ signed int rtw_set_key(struct adapter *adapter, struct security_priv *psecurityp 
	struct cmd_priv *pcmdpriv = &adapter->cmdpriv;

	signed int	res = _SUCCESS;



	psetkeyparm = rtw_zmalloc(sizeof(struct setkey_parm));

	psetkeyparm = kzalloc(sizeof(*psetkeyparm), GFP_KERNEL);

	if (!psetkeyparm) {

		res = _FAIL;

		goto exit;
@@ -1954,7 +1954,7 @@ signed int rtw_set_key(struct adapter *adapter, struct security_priv *psecurityp 
	}



	if (enqueue) {

		pcmd = rtw_zmalloc(sizeof(struct cmd_obj));

		pcmd = kzalloc(sizeof(*pcmd), GFP_KERNEL);

		if (!pcmd) {

			kfree(psetkeyparm);

			res = _FAIL;  /* try again */
@@ -2061,7 +2061,7 @@ static void rtw_report_sec_ie(struct adapter *adapter, u8 authmode, u8 *sec_ie) 


	buff = NULL;

	if (authmode == WLAN_EID_VENDOR_SPECIFIC) {

		buff = rtw_zmalloc(IW_CUSTOM_MAX);

		buff = kzalloc(IW_CUSTOM_MAX, GFP_ATOMIC);

		if (!buff)

			return;

drivers/staging/rtl8723bs/core/rtw_mlme_ext.c

+18 −18
Original line number Diff line number Diff line
@@ -2327,7 +2327,7 @@ void issue_probersp(struct adapter *padapter, unsigned char *da, u8 is_valid_p2p 
			u8 *buf;

			u8 *ies = pmgntframe->buf_addr+TXDESC_OFFSET+sizeof(struct ieee80211_hdr_3addr);



			buf = rtw_zmalloc(MAX_IE_SZ);

			buf = kzalloc(MAX_IE_SZ, GFP_ATOMIC);

			if (!buf)

				return;
@@ -4376,12 +4376,12 @@ void report_survey_event(struct adapter *padapter, union recv_frame *precv_frame 
	pmlmeext = &padapter->mlmeextpriv;

	pcmdpriv = &padapter->cmdpriv;



	pcmd_obj = rtw_zmalloc(sizeof(struct cmd_obj));

	pcmd_obj = kzalloc(sizeof(*pcmd_obj), GFP_ATOMIC);

	if (!pcmd_obj)

		return;



	cmdsz = (sizeof(struct survey_event) + sizeof(struct C2HEvent_Header));

	pevtcmd = rtw_zmalloc(cmdsz);

	pevtcmd = kzalloc(cmdsz, GFP_ATOMIC);

	if (!pevtcmd) {

		kfree(pcmd_obj);

		return;
@@ -4429,12 +4429,12 @@ void report_surveydone_event(struct adapter *padapter) 
	struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;

	struct cmd_priv *pcmdpriv = &padapter->cmdpriv;



	pcmd_obj = rtw_zmalloc(sizeof(struct cmd_obj));

	pcmd_obj = kzalloc(sizeof(*pcmd_obj), GFP_ATOMIC);

	if (!pcmd_obj)

		return;



	cmdsz = (sizeof(struct surveydone_event) + sizeof(struct C2HEvent_Header));

	pevtcmd = rtw_zmalloc(cmdsz);

	pevtcmd = kzalloc(cmdsz, GFP_ATOMIC);

	if (!pevtcmd) {

		kfree(pcmd_obj);

		return;
@@ -4474,12 +4474,12 @@ void report_join_res(struct adapter *padapter, int res) 
	struct mlme_ext_info *pmlmeinfo = &pmlmeext->mlmext_info;

	struct cmd_priv *pcmdpriv = &padapter->cmdpriv;



	pcmd_obj = rtw_zmalloc(sizeof(struct cmd_obj));

	pcmd_obj = kzalloc(sizeof(*pcmd_obj), GFP_ATOMIC);

	if (!pcmd_obj)

		return;



	cmdsz = (sizeof(struct joinbss_event) + sizeof(struct C2HEvent_Header));

	pevtcmd = rtw_zmalloc(cmdsz);

	pevtcmd = kzalloc(cmdsz, GFP_ATOMIC);

	if (!pevtcmd) {

		kfree(pcmd_obj);

		return;
@@ -4523,12 +4523,12 @@ void report_wmm_edca_update(struct adapter *padapter) 
	struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;

	struct cmd_priv *pcmdpriv = &padapter->cmdpriv;



	pcmd_obj = rtw_zmalloc(sizeof(struct cmd_obj));

	pcmd_obj = kzalloc(sizeof(*pcmd_obj), GFP_ATOMIC);

	if (!pcmd_obj)

		return;



	cmdsz = (sizeof(struct wmm_event) + sizeof(struct C2HEvent_Header));

	pevtcmd = rtw_zmalloc(cmdsz);

	pevtcmd = kzalloc(cmdsz, GFP_ATOMIC);

	if (!pevtcmd) {

		kfree(pcmd_obj);

		return;
@@ -4569,12 +4569,12 @@ void report_del_sta_event(struct adapter *padapter, unsigned char *MacAddr, unsi 
	struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;

	struct cmd_priv *pcmdpriv = &padapter->cmdpriv;



	pcmd_obj = rtw_zmalloc(sizeof(struct cmd_obj));

	pcmd_obj = kzalloc(sizeof(*pcmd_obj), GFP_ATOMIC);

	if (!pcmd_obj)

		return;



	cmdsz = (sizeof(struct stadel_event) + sizeof(struct C2HEvent_Header));

	pevtcmd = rtw_zmalloc(cmdsz);

	pevtcmd = kzalloc(cmdsz, GFP_ATOMIC);

	if (!pevtcmd) {

		kfree(pcmd_obj);

		return;
@@ -4620,12 +4620,12 @@ void report_add_sta_event(struct adapter *padapter, unsigned char *MacAddr, int 
	struct mlme_ext_priv *pmlmeext = &padapter->mlmeextpriv;

	struct cmd_priv *pcmdpriv = &padapter->cmdpriv;



	pcmd_obj = rtw_zmalloc(sizeof(struct cmd_obj));

	pcmd_obj = kzalloc(sizeof(*pcmd_obj), GFP_ATOMIC);

	if (!pcmd_obj)

		return;



	cmdsz = (sizeof(struct stassoc_event) + sizeof(struct C2HEvent_Header));

	pevtcmd = rtw_zmalloc(cmdsz);

	pevtcmd = kzalloc(cmdsz, GFP_ATOMIC);

	if (!pevtcmd) {

		kfree(pcmd_obj);

		return;
@@ -5074,11 +5074,11 @@ void survey_timer_hdl(struct timer_list *t) 
			pmlmeext->scan_abort = false;/* reset */

		}



		ph2c = rtw_zmalloc(sizeof(struct cmd_obj));

		ph2c = kzalloc(sizeof(*ph2c), GFP_ATOMIC);

		if (!ph2c)

			return;



		psurveyPara = rtw_zmalloc(sizeof(struct sitesurvey_parm));

		psurveyPara = kzalloc(sizeof(*psurveyPara), GFP_ATOMIC);

		if (!psurveyPara) {

			kfree(ph2c);

			return;
@@ -5689,7 +5689,7 @@ u8 chk_bmc_sleepq_cmd(struct adapter *padapter) 
	struct cmd_priv *pcmdpriv = &(padapter->cmdpriv);

	u8 res = _SUCCESS;



	ph2c = rtw_zmalloc(sizeof(struct cmd_obj));

	ph2c = kzalloc(sizeof(*ph2c), GFP_ATOMIC);

	if (!ph2c) {

		res = _FAIL;

		goto exit;
@@ -5713,13 +5713,13 @@ u8 set_tx_beacon_cmd(struct adapter *padapter) 
	u8 res = _SUCCESS;

	int len_diff = 0;



	ph2c = rtw_zmalloc(sizeof(struct cmd_obj));

	ph2c = kzalloc(sizeof(*ph2c), GFP_ATOMIC);

	if (!ph2c) {

		res = _FAIL;

		goto exit;

	}



	ptxBeacon_parm = rtw_zmalloc(sizeof(struct Tx_Beacon_param));

	ptxBeacon_parm = kzalloc(sizeof(*ptxBeacon_parm), GFP_ATOMIC);

	if (!ptxBeacon_parm) {

		kfree(ph2c);

		res = _FAIL;

drivers/staging/rtl8723bs/core/rtw_recv.c

+1 −1
Original line number Diff line number Diff line
@@ -1425,7 +1425,7 @@ static signed int validate_80211w_mgmt(struct adapter *adapter, union recv_frame 
			memcpy(pattrib->ta, GetAddr2Ptr(ptr), ETH_ALEN);

			/* actual management data frame body */

			data_len = pattrib->pkt_len - pattrib->hdrlen - pattrib->iv_len - pattrib->icv_len;

			mgmt_DATA = rtw_zmalloc(data_len);

			mgmt_DATA = kzalloc(data_len, GFP_ATOMIC);

			if (!mgmt_DATA)

				goto validate_80211w_fail;

			precv_frame = decryptor(adapter, precv_frame);