Skip to contentSkip to conversation

b43: Fix possible NULL pointer dereference in DMA code

PATCH In review Michael Buesch 2 participants 2 messages Jun 14, 2008 – Jun 15, 2008

lore
Share & tools
lore
#0 lore raw

PATCH 1/1 b43: Fix possible NULL pointer dereference in DMA code

This fixes a possible NULL pointer dereference in an error path of the DMA allocation error checking code. In case the DMA allocation address is invalid, the dev pointer is dereferenced for unmapping of the buffer.

This is a cut-down version of 3ab4b64c46784ed83f213bf4e1b51d9c55858600 which is upstream in John Linville's wireless-testing.git tree.

drivers/net/wireless/b43/dma.c +1 -1
Index: linux-2.6.25.6/drivers/net/wireless/b43/dma.c
===================================================================
@@ -847,12 +847,13 @@ struct b43_dmaring *b43_setup_dmaring(st
 	dma_addr_t dma_test;
 
 	ring = kzalloc(sizeof(*ring), GFP_KERNEL);
 	if (!ring)
 		goto out;
 	ring->type = type;
+	ring->dev = dev;
 
 	nr_slots = B43_RXRING_SLOTS;
 	if (for_tx)
 		nr_slots = B43_TXRING_SLOTS;
 
 	ring->meta = kcalloc(nr_slots, sizeof(struct b43_dmadesc_meta),
@@ -898,13 +899,12 @@ struct b43_dmaring *b43_setup_dmaring(st
 
 		dma_unmap_single(dev->dev->dma_dev,
 				 dma_test, b43_txhdr_size(dev),
 				 DMA_TO_DEVICE);
 	}
 
-	ring->dev = dev;
 	ring->nr_slots = nr_slots;
 	ring->mmio_base = b43_dmacontroller_base(type, controller_index);
 	ring->index = controller_index;
 	if (type == B43_DMA_64BIT)
 		ring->ops = &dma64_ops;
 	else
#1 lore raw
Quoted 6 lines · Michael Buesch

This fixes a possible NULL pointer dereference in an error path of the DMA allocation error checking code. In case the DMA allocation address is invalid, the dev pointer is dereferenced for unmapping of the buffer.

This is a cut-down version of 3ab4b64c46784ed83f213bf4e1b51d9c55858600 which is upstream in John Linville's wireless-testing.git tree.

...which will probably be 028118a5f09a9c807e6b43e2231efdff9f224c74 in linux-2.6.git

John

Signature · 2 lines
John W. Linville
[email protected]