diff options
| author |   Abraham Arce <abraham.arce.moreno@gmail.com> | 2010-04-16 14:48:43 +0000 |
|---|---|---|
| committer |   David S. Miller <davem@davemloft.net> | 2010-04-21 16:29:22 -0700 |
| commit | 761172fbf672c5784b2a0d71ca2f4389eb7a2c21 (patch) | |
| tree | e52513d9473d51eb64722962bbbbdaf28a5b05f7 /drivers/net/ks8851.c | |
| parent | net: 3c574_cs fix stats.tx_bytes counter (diff) | |
| download | linux-dev-761172fbf672c5784b2a0d71ca2f4389eb7a2c21.tar.xz linux-dev-761172fbf672c5784b2a0d71ca2f4389eb7a2c21.zip | |
KS8851: NULL pointer dereference if list is empty
Fix NULL pointer dereference in ks8851_tx_work by checking if dequeued
list is already empty before writing the packet to TX FIFO
Unable to handle kernel NULL pointer dereference at virtual address 00000050
PC is at ks8851_tx_work+0xdc/0x1b0
LR is at wait_for_common+0x148/0x164
pc : [<c01c0df4>] lr : [<c025a980>] psr: 20000013
Backtrace:
ks8851_tx_work+0x0/0x1b0
worker_thread+0x0/0x190
kthread+0x0/0x90
Signed-off-by: Abraham Arce <x0066660@ti.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net/ks8851.c')
| -rw-r--r-- | drivers/net/ks8851.c | 12 |
1 files changed, 7 insertions, 5 deletions
diff --git a/drivers/net/ks8851.c b/drivers/net/ks8851.c index 13cc1ca261d9..9e9f9b349766 100644 --- a/drivers/net/ks8851.c +++ b/drivers/net/ks8851.c @@ -722,12 +722,14 @@ static void ks8851_tx_work(struct work_struct *work) txb = skb_dequeue(&ks->txq); last = skb_queue_empty(&ks->txq); - ks8851_wrreg16(ks, KS_RXQCR, ks->rc_rxqcr | RXQCR_SDA); - ks8851_wrpkt(ks, txb, last); - ks8851_wrreg16(ks, KS_RXQCR, ks->rc_rxqcr); - ks8851_wrreg16(ks, KS_TXQCR, TXQCR_METFE); + if (txb != NULL) { + ks8851_wrreg16(ks, KS_RXQCR, ks->rc_rxqcr | RXQCR_SDA); + ks8851_wrpkt(ks, txb, last); + ks8851_wrreg16(ks, KS_RXQCR, ks->rc_rxqcr); + ks8851_wrreg16(ks, KS_TXQCR, TXQCR_METFE); - ks8851_done_tx(ks, txb); + ks8851_done_tx(ks, txb); + } } mutex_unlock(&ks->lock); |