From mboxrd@z Thu Jan 1 00:00:00 1970 Return-path: Received: from ns2.suse.de ([195.135.220.15]:42714 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754986AbYFSVcF (ORCPT ); Thu, 19 Jun 2008 17:32:05 -0400 Date: Thu, 19 Jun 2008 14:29:56 -0700 From: Greg KH To: linux-kernel@vger.kernel.org, stable@kernel.org Cc: Justin Forbes , Zwane Mwaikambo , Theodore Ts'o , Randy Dunlap , Dave Jones , Chuck Wolber , Chris Wedgwood , Michael Krufky , Chuck Ebbert , Domenico Andreoli , Willy Tarreau , Rodrigo Rubira Branco , torvalds@linux-foundation.org, akpm@linux-foundation.org, alan@lxorguk.ukuu.org.uk, linux-wireless@vger.kernel.org, bcm43xx-dev@lists.berlios.de, Michael Buesch , "John W. Linville" Subject: [patch 07/15] b43: Fix possible NULL pointer dereference in DMA code Message-ID: <20080619212956.GH20267@suse.de> (sfid-20080619_233211_906477_5C30B344) References: <20080619211313.834170620@mini.kroah.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii In-Reply-To: <20080619212621.GA20267@suse.de> Sender: linux-wireless-owner@vger.kernel.org List-ID: 2.6.25-stable review patch. If anyone has any objections, please let us know. ------------------ From: Michael Buesch a cut-down version of commit 028118a5f09a9c807e6b43e2231efdff9f224c74 upstream This fixes a possible NULL pointer dereference in an error path of the DMA allocation error checking code. In case the DMA allocation address is invalid, the dev pointer is dereferenced for unmapping of the buffer. Reported-by: Miles Lane Signed-off-by: Michael Buesch Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman --- drivers/net/wireless/b43/dma.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/net/wireless/b43/dma.c +++ b/drivers/net/wireless/b43/dma.c @@ -850,6 +850,7 @@ struct b43_dmaring *b43_setup_dmaring(st if (!ring) goto out; ring->type = type; + ring->dev = dev; nr_slots = B43_RXRING_SLOTS; if (for_tx) @@ -901,7 +902,6 @@ struct b43_dmaring *b43_setup_dmaring(st DMA_TO_DEVICE); } - ring->dev = dev; ring->nr_slots = nr_slots; ring->mmio_base = b43_dmacontroller_base(type, controller_index); ring->index = controller_index; --