diff options
| author | Reinette Chatre <reinette.chatre@intel.com> | 2008-01-21 18:08:31 (GMT) |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2008-01-23 11:11:41 (GMT) |
| commit | a781cf94e6dcc09bf13e548298185d916d9ff3c8 (patch) | |
| tree | a4aa53c18545ed3f9e4ab0ff6bb7184b37ee6c01 | |
| parent | 1e34a11d55c9437775367d72ad03f9af99e78bd0 (diff) | |
| download | linux-fsl-qoriq-a781cf94e6dcc09bf13e548298185d916d9ff3c8.tar.xz | |
iwlwifi: fix possible read attempt on ucode that is not available
This fixes a NULL pointer dereference that can occur when the
ucode is not loaded at the time __iwl_up is called.
The problem was reported at http://kerneloops.org/raw.php?rawid=2765&msgid=
Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
| -rw-r--r-- | drivers/net/wireless/iwlwifi/iwl3945-base.c | 5 | ||||
| -rw-r--r-- | drivers/net/wireless/iwlwifi/iwl4965-base.c | 5 |
2 files changed, 10 insertions, 0 deletions
diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c index 1a6b0e0..0b3ec7e 100644 --- a/drivers/net/wireless/iwlwifi/iwl3945-base.c +++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c @@ -6342,6 +6342,11 @@ static int __iwl_up(struct iwl_priv *priv) return 0; } + if (!priv->ucode_data_backup.v_addr || !priv->ucode_data.v_addr) { + IWL_ERROR("ucode not available for device bringup\n"); + return -EIO; + } + iwl_write32(priv, CSR_INT, 0xFFFFFFFF); rc = iwl_hw_nic_init(priv); diff --git a/drivers/net/wireless/iwlwifi/iwl4965-base.c b/drivers/net/wireless/iwlwifi/iwl4965-base.c index 6cd57c2..15a45f4 100644 --- a/drivers/net/wireless/iwlwifi/iwl4965-base.c +++ b/drivers/net/wireless/iwlwifi/iwl4965-base.c @@ -6698,6 +6698,11 @@ static int __iwl_up(struct iwl_priv *priv) return 0; } + if (!priv->ucode_data_backup.v_addr || !priv->ucode_data.v_addr) { + IWL_ERROR("ucode not available for device bringup\n"); + return -EIO; + } + iwl_write32(priv, CSR_INT, 0xFFFFFFFF); rc = iwl_hw_nic_init(priv); |