[PATCH Linux-2.6.8-rc1] prism54 Fix null pointer reference (Bug 100)

[PATCH Linux-2.6.8-rc1] prism54 Fix null pointer reference (Bug 100)

[Margit Schubert-While]

[-- Attachment #1: Type: text/plain, Size: 171 bytes --]

2004-07-22 Margit Schubert-While <margitsw@t-online.de>

* prism54_get/set_debug_oid are missing checks for a null pointer.
  Reported in Bugzilla number 100.

Margit





[-- Attachment #2: bugptr.patch --]
[-- Type: text/x-diff, Size: 1634 bytes --]

diff -Naur linux-2.6.8-01/drivers/net/wireless/prism54/isl_ioctl.c linux-2.6.8-04/drivers/net/wireless/prism54/isl_ioctl.c
--- linux-2.6.8-01/drivers/net/wireless/prism54/isl_ioctl.c	2004-07-01 07:23:52.000000000 +0200
+++ linux-2.6.8-04/drivers/net/wireless/prism54/isl_ioctl.c	2004-07-26 10:35:17.000000000 +0200
@@ -1942,7 +1942,7 @@
 {
 	islpci_private *priv = netdev_priv(ndev);
 	struct islpci_mgmtframe *response = NULL;
-	int ret = -EIO, response_op = PIMFOR_OP_ERROR;
+	int ret = -EIO;
 
 	printk("%s: get_oid 0x%08X\n", ndev->name, priv->priv_oid);
 	data->length = 0;
@@ -1952,9 +1952,7 @@
 		    islpci_mgt_transaction(priv->ndev, PIMFOR_OP_GET,
 					   priv->priv_oid, extra, 256,
 					   &response);
-		response_op = response->header->operation;
 		printk("%s: ret: %i\n", ndev->name, ret);
-		printk("%s: response_op: %i\n", ndev->name, response_op);
 		if (ret || !response
 		    || response->header->operation == PIMFOR_OP_ERROR) {
 			if (response) {
@@ -1991,16 +1989,20 @@
 					   priv->priv_oid, extra, data->length,
 					   &response);
 		printk("%s: ret: %i\n", ndev->name, ret);
+		if (ret || !response
+		    || response->header->operation == PIMFOR_OP_ERROR) {
+			if (response) {
+				islpci_mgt_release(response);
+			}
+			printk("%s: EIO\n", ndev->name);
+			ret = -EIO;
+		}
 		if (!ret) {
 			response_op = response->header->operation;
 			printk("%s: response_op: %i\n", ndev->name,
 			       response_op);
 			islpci_mgt_release(response);
 		}
-		if (ret || response_op == PIMFOR_OP_ERROR) {
-			printk("%s: EIO\n", ndev->name);
-			ret = -EIO;
-		}
 	}
 
 	return (ret ? ret : -EINPROGRESS);

[-- Attachment #3: Type: text/plain, Size: 151 bytes --]

_______________________________________________
Prism54-devel mailing list
Prism54-devel@prism54.org
http://prism54.org/mailman/listinfo/prism54-devel

Re: [PATCH Linux-2.6.8-rc1] prism54 Fix null pointer reference (Bug 100)

[Jeff Garzik]

applied