diff options
| author |   Inaky Perez-Gonzalez <inaky@linux.intel.com> | 2009-05-27 01:04:40 -0700 |
|---|---|---|
| committer | Inaky Perez-Gonzalez <inaky@linux.intel.com> | 2009-06-11 03:30:22 -0700 |
| commit | 59063afa0afabc68d2b6ca0d106da9165e1c7d39 (patch) | |
| tree | 4fda5f5feaa11a8d311661cd0630d06ad29c8aa7 /drivers/net/wimax | |
| parent | wimax/i2400m: don't reset device on i2400m_dev_shutdown() (diff) | |
| download | linux-dev-59063afa0afabc68d2b6ca0d106da9165e1c7d39.tar.xz linux-dev-59063afa0afabc68d2b6ca0d106da9165e1c7d39.zip | |
wimax/i2400m: fix oops when the TX FIFO fills up due to a missing check
When the TX FIFO filled up and i2400m_tx_new() failed to allocate a
new TX message header, a missing check for said condition was causing a
kernel oops when trying to dereference a NULL i2400m->tx_msg pointer.
Found and diagnosed by Cindy H. Kao.
Signed-off-by: Inaky Perez-Gonzalez <inaky@linux.intel.com>
Diffstat (limited to 'drivers/net/wimax')
| -rw-r--r-- | drivers/net/wimax/i2400m/tx.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/drivers/net/wimax/i2400m/tx.c b/drivers/net/wimax/i2400m/tx.c index 4295dcf96ee2..fa16ccf8e26a 100644 --- a/drivers/net/wimax/i2400m/tx.c +++ b/drivers/net/wimax/i2400m/tx.c @@ -653,6 +653,8 @@ try_new: i2400m_tx_close(i2400m); i2400m_tx_new(i2400m); } + if (i2400m->tx_msg == NULL) + goto error_tx_new; if (i2400m->tx_msg->size + padded_len > I2400M_TX_BUF_SIZE / 2) { d_printf(2, dev, "TX: message too big, going new\n"); i2400m_tx_close(i2400m); |