Преглед на файлове

iwlwifi: fix possible read attempt on ucode that is not available

This fixes a NULL pointer dereference that can occur when the
ucode is not loaded at the time __iwl_up is called.

The problem was reported at http://kerneloops.org/raw.php?rawid=2765&msgid=

Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Reinette Chatre преди 17 години
родител
ревизия
a781cf94e6
променени са 2 файла, в които са добавени 10 реда и са изтрити 0 реда
  1. 5 0
      drivers/net/wireless/iwlwifi/iwl3945-base.c
  2. 5 0
      drivers/net/wireless/iwlwifi/iwl4965-base.c

+ 5 - 0
drivers/net/wireless/iwlwifi/iwl3945-base.c

@@ -6342,6 +6342,11 @@ static int __iwl_up(struct iwl_priv *priv)
 		return 0;
 	}
 
+	if (!priv->ucode_data_backup.v_addr || !priv->ucode_data.v_addr) {
+		IWL_ERROR("ucode not available for device bringup\n");
+		return -EIO;
+	}
+
 	iwl_write32(priv, CSR_INT, 0xFFFFFFFF);
 
 	rc = iwl_hw_nic_init(priv);

+ 5 - 0
drivers/net/wireless/iwlwifi/iwl4965-base.c

@@ -6698,6 +6698,11 @@ static int __iwl_up(struct iwl_priv *priv)
 		return 0;
 	}
 
+	if (!priv->ucode_data_backup.v_addr || !priv->ucode_data.v_addr) {
+		IWL_ERROR("ucode not available for device bringup\n");
+		return -EIO;
+	}
+
 	iwl_write32(priv, CSR_INT, 0xFFFFFFFF);
 
 	rc = iwl_hw_nic_init(priv);