diff options
| author | Christian Lamparter <chunkeey@googlemail.com> | 2010-11-20 12:15:27 (GMT) |
|---|---|---|
| committer | John W. Linville <linville@tuxdriver.com> | 2010-11-22 20:19:32 (GMT) |
| commit | b397492a8c1022887a9b2fb925fe92e69ce0ad4d (patch) | |
| tree | 694e3d428ed26e8fc38492dfdacdc3979fac066b /drivers/net/wireless/ath | |
| parent | 1d8638d4038eb8709edc80e37a0bbb77253d86e9 (diff) | |
| download | linux-b397492a8c1022887a9b2fb925fe92e69ce0ad4d.tar.xz | |
carl9170: fix virtual interface setup crash
This patch fixes a faulty bound check which caused a
crash when too many virtual interface were brought up.
BUG: unable to handle kernel NULL pointer dereference at 00000004
IP: [<f8125f67>] carl9170_op_add_interface+0x1d7/0x2c0 [carl9170]
*pde = 00000000
Oops: 0002 [#1] PREEMPT
Modules linked in: carl9170 [...]
Pid: 4720, comm: wpa_supplicant Not tainted 2.6.37-rc2-wl+
EIP: 0060:[<f8125f67>] EFLAGS: 00210206 CPU: 0
EIP is at carl9170_op_add_interface+0x1d7/0x2c0 [carl9170]
EAX: 00000000 ...
Process wpa_supplicant
Stack:
f4f88f34 fffffff4 ..
Call Trace:
[<f8f4e666>] ? ieee80211_do_open+0x406/0x5c0 [mac80211]
[...]
Code: <89> 42 04 ...
EIP: [<f8125f67>] carl9170_op_add_interface+0x1d7/0x2c0 [carl9170]
CR2: 0000000000000004
Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'drivers/net/wireless/ath')
| -rw-r--r-- | drivers/net/wireless/ath/carl9170/main.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/wireless/ath/carl9170/main.c b/drivers/net/wireless/ath/carl9170/main.c index 980ae70..a314c2c 100644 --- a/drivers/net/wireless/ath/carl9170/main.c +++ b/drivers/net/wireless/ath/carl9170/main.c @@ -647,7 +647,7 @@ init: } unlock: - if (err && (vif_id != -1)) { + if (err && (vif_id >= 0)) { vif_priv->active = false; bitmap_release_region(&ar->vif_bitmap, vif_id, 0); ar->vifs--; |