lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

ath9k: RX buffers may be accessed/freed even before initialized/alloced.

Browse Source 
accessing RXBUF list in ath_rx_cleanup may cause panic if
ath_descdma_setup fails even before RXBUF list is initialized.

Signed-off-by: Senthil Balasubramanian <senthilkumar@atheros.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
This commit is contained in:
Senthil Balasubramanian
2009-03-06 11:24:09 +05:30
committed by John W. Linville
parent f0e6ce13c1
commit b03a9db95a
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/net/wireless/ath9k/main.c
View File

@@ -1773,6 +1773,7 @@ int ath_descdma_setup(struct ath_softc *sc, struct ath_descdma *dd,
DPRINTF(sc, ATH_DBG_CONFIG, "%s DMA: %u buffers %u desc/buf\n", DPRINTF(sc, ATH_DBG_CONFIG, "%s DMA: %u buffers %u desc/buf\n",
name, nbuf, ndesc); name, nbuf, ndesc);
INIT_LIST_HEAD(head);
/* ath_desc must be a multiple of DWORDs */ /* ath_desc must be a multiple of DWORDs */
if ((sizeof(struct ath_desc) % 4) != 0) { if ((sizeof(struct ath_desc) % 4) != 0) {
DPRINTF(sc, ATH_DBG_FATAL, "ath_desc not DWORD aligned\n"); DPRINTF(sc, ATH_DBG_FATAL, "ath_desc not DWORD aligned\n");
@@ -1823,7 +1824,6 @@ int ath_descdma_setup(struct ath_softc *sc, struct ath_descdma *dd,
} }
dd->dd_bufptr = bf; dd->dd_bufptr = bf;
INIT_LIST_HEAD(head);
for (i = 0; i < nbuf; i++, bf++, ds += ndesc) { for (i = 0; i < nbuf; i++, bf++, ds += ndesc) {
bf->bf_desc = ds; bf->bf_desc = ds;
bf->bf_daddr = DS2PHYS(dd, ds); bf->bf_daddr = DS2PHYS(dd, ds);