[patch 07/15] b43: Fix possible NULL pointer dereference in DMA code
in [Kernel]
|
Prev: [patch 09/15] ACPICA: Ignore ACPI table signature for Load() operator
Next: [patch 03/15] opti621: disable read prefetch
From: Greg KH on 19 Jun 2008 17:40 2.6.25-stable review patch. If anyone has any objections, please let us know. ------------------ From: Michael Buesch <mb(a)bu3sch.de> a cut-down version of commit 028118a5f09a9c807e6b43e2231efdff9f224c74 upstream This fixes a possible NULL pointer dereference in an error path of the DMA allocation error checking code. In case the DMA allocation address is invalid, the dev pointer is dereferenced for unmapping of the buffer. Reported-by: Miles Lane <miles.lane(a)gmail.com> Signed-off-by: Michael Buesch <mb(a)bu3sch.de> Signed-off-by: John W. Linville <linville(a)tuxdriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)suse.de> --- drivers/net/wireless/b43/dma.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/net/wireless/b43/dma.c +++ b/drivers/net/wireless/b43/dma.c @@ -850,6 +850,7 @@ struct b43_dmaring *b43_setup_dmaring(st if (!ring) goto out; ring->type = type; + ring->dev = dev; nr_slots = B43_RXRING_SLOTS; if (for_tx) @@ -901,7 +902,6 @@ struct b43_dmaring *b43_setup_dmaring(st DMA_TO_DEVICE); } - ring->dev = dev; ring->nr_slots = nr_slots; ring->mmio_base = b43_dmacontroller_base(type, controller_index); ring->index = controller_index; -- -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo(a)vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/ |