Home » Mailing list archives » linux-kernel » 2008 » June » 19

[patch 07/15] b43: Fix possible NULL pointer dereference in DMA code

!MAILaRCHIVE_VOTE_RePLACE
Previous message: [thread] [date] [author]
Next message: [thread] [date] [author]
[view in full thread]
From: Greg KH <gregkh@...>
To: <linux-kernel@...>, <stable@...>
Cc: Justin Forbes <jmforbes@...>, Zwane Mwaikambo <zwane@...>, Theodore Ts'o <tytso@...>, Randy Dunlap <rdunlap@...>, Dave Jones <davej@...>, Chuck Wolber <chuckw@...>, Chris Wedgwood <reviews@...>, Michael Krufky <mkrufky@...>, Chuck Ebbert <cebbert@...>, Domenico Andreoli <cavokz@...>, Willy Tarreau <w@...>, Rodrigo Rubira Branco <rbranco@...>, <torvalds@...>, <akpm@...>, <alan@...>, <linux-wireless@...>, <bcm43xx-dev@...>, Michael Buesch <mb@...>, John W. Linville <linville@...>
Subject: [patch 07/15] b43: Fix possible NULL pointer dereference in DMA code
Date: Thursday, June 19, 2008 - 5:29 pm

2.6.25-stable review patch.  If anyone has any objections, please let us
know.

------------------
From: Michael Buesch <mb@bu3sch.de>

a cut-down version of commit 028118a5f09a9c807e6b43e2231efdff9f224c74 upstream

This fixes a possible NULL pointer dereference in an error path of the
DMA allocation error checking code. In case the DMA allocation address is invalid,
the dev pointer is dereferenced for unmapping of the buffer.

Reported-by: Miles Lane <miles.lane@gmail.com>
Signed-off-by: Michael Buesch <mb@bu3sch.de>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 drivers/net/wireless/b43/dma.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/net/wireless/b43/dma.c
+++ b/drivers/net/wireless/b43/dma.c
@@ -850,6 +850,7 @@ struct b43_dmaring *b43_setup_dmaring(st
 	if (!ring)
 		goto out;
 	ring->type = type;
+	ring->dev = dev;
 
 	nr_slots = B43_RXRING_SLOTS;
 	if (for_tx)
@@ -901,7 +902,6 @@ struct b43_dmaring *b43_setup_dmaring(st
 				 DMA_TO_DEVICE);
 	}
 
-	ring->dev = dev;
 	ring->nr_slots = nr_slots;
 	ring->mmio_base = b43_dmacontroller_base(type, controller_index);
 	ring->index = controller_index;

-- 
--
Previous message: [thread] [date] [author]
Next message: [thread] [date] [author]
Messages in current thread:
[00/15] 2.6.25-stable review, Greg KH, (Thu Jun 19, 5:26 pm)
[patch 15/15] x86: disable mwait for AMD family 10H/11H CPUs, Greg KH, (Thu Jun 19, 5:30 pm)
[patch 14/15] x86: remove mwait capability C-state check, Greg KH, (Thu Jun 19, 5:30 pm)
[patch 13/15] nf_conntrack_h323: fix memory leak in module i..., Greg KH, (Thu Jun 19, 5:30 pm)
[patch 12/15] nf_conntrack_h323: fix module unload crash, Greg KH, (Thu Jun 19, 5:30 pm)
[patch 11/15] nf_conntrack: fix ctnetlink related crash in n..., Greg KH, (Thu Jun 19, 5:30 pm)
[patch 10/15] SCSI: sr: fix corrupt CD data after media chan..., Greg KH, (Thu Jun 19, 5:30 pm)
[patch 09/15] ACPICA: Ignore ACPI table signature for Load()..., Greg KH, (Thu Jun 19, 5:30 pm)
Re: [patch 09/15] ACPICA: Ignore ACPI table signature for Lo..., , (Fri Jun 27, 6:14 am)
[patch 08/15] scsi_host regression: fix scsi host leak, Greg KH, (Thu Jun 19, 5:29 pm)
[patch 07/15] b43: Fix possible NULL pointer dereference in ..., Greg KH, (Thu Jun 19, 5:29 pm)
[patch 06/15] b43: Fix noise calculation WARN_ON, Greg KH, (Thu Jun 19, 5:29 pm)
[patch 05/15] virtio_net: Fix skb-&gt;csum_start computation, Greg KH, (Thu Jun 19, 5:29 pm)
[patch 04/15] opti621: remove DMA support, Greg KH, (Thu Jun 19, 5:29 pm)
[patch 03/15] opti621: disable read prefetch, Greg KH, (Thu Jun 19, 5:29 pm)
[patch 02/15] Fix tty speed handling on 8250, Greg KH, (Thu Jun 19, 5:29 pm)
[patch 01/15] x86-64: Fix "bytes left to copy" return value ..., Greg KH, (Thu Jun 19, 5:29 pm)