All of lore.kernel.org
 help / color / mirror / Atom feed
From: Ivan Vecera <ivecera@redhat.com>
To: linux-kernel@vger.kernel.org
Cc: romieu@fr.zoreil.com
Subject: [PATCH] NET: r8169: fix oops in r8169_get_mac_version
Date: Thu, 17 Apr 2008 17:02:06 +0200	[thread overview]
Message-ID: <4807666E.7070803@redhat.com> (raw)

When does r8169_get_mac_version find unknown MAC then kernel crash occurs
because tp->pci_dev is NULL and is dereferenced. Problem is that the function
r8169_get_mac_version is called from rtl8169_init_one at line 1704 but
tp->pci_dev is filled at line 1780.

Ivan

---
diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
index 3acfeea..a45c8e8 100644
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -1700,6 +1700,9 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
 		msleep_interruptible(1);
 	}
 
+	/* rtl8169_get_mac_version uses tp->pci_dev when unknown MAC found */
+	tp->pci_dev = pdev;
+
 	/* Identify chip attached to board */
 	rtl8169_get_mac_version(tp, ioaddr);
 
@@ -1777,7 +1780,6 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
 #endif
 
 	tp->intr_mask = 0xffff;
-	tp->pci_dev = pdev;
 	tp->mmio_addr = ioaddr;
 	tp->align = cfg->align;
 	tp->hw_start = cfg->hw_start;

                 reply	other threads:[~2008-04-17 15:02 UTC|newest]

Thread overview: [no followups] expand[flat|nested]  mbox.gz  Atom feed

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=4807666E.7070803@redhat.com \
    --to=ivecera@redhat.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=romieu@fr.zoreil.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.