diff options
author | Jussi Kivilinna <jussi.kivilinna@mbnet.fi> | 2008-03-23 06:45:44 -0400 |
---|---|---|
committer | Jeff Garzik <jeff@garzik.org> | 2008-03-25 23:42:06 -0400 |
commit | 9f5e60dd5ffca938da4cabc197af8b9405b5512e (patch) | |
tree | e6764734215126ccbcac1c7e52b0e48f117df7c0 /drivers | |
parent | b1186dee3e785679876f6b629609ec080842edda (diff) |
rndis_host: fix oops when query for OID_GEN_PHYSICAL_MEDIUM fails
When query for OID_GEN_PHYSICAL_MEDIUM fails, uninitialized pointer
'phym' is being accessed in generic_rndis_bind(), resulting OOPS.
Patch fixes phym to be initialized and setup correctly when
rndis_query() for physical medium fails.
Bug was introduced by following commit:
commit 039ee17d1baabaa21783a0d5ab3e8c6d8c794bdf
Author: Jussi Kivilinna <jussi.kivilinna@mbnet.fi>
Date: Sun Jan 27 23:34:33 2008 +0200
Reported-by: Dmitri Monakhov <dmonakhov@openvz.org>
Signed-off-by: Jussi Kivilinna <jussi.kivilinna@mbnet.fi>
Acked-by: David Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: Jeff Garzik <jeff@garzik.org>
Diffstat (limited to 'drivers')
-rw-r--r-- | drivers/net/usb/rndis_host.c | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/drivers/net/usb/rndis_host.c b/drivers/net/usb/rndis_host.c index 727547a2899..369c731114b 100644 --- a/drivers/net/usb/rndis_host.c +++ b/drivers/net/usb/rndis_host.c | |||
@@ -283,7 +283,7 @@ generic_rndis_bind(struct usbnet *dev, struct usb_interface *intf, int flags) | |||
283 | struct rndis_set_c *set_c; | 283 | struct rndis_set_c *set_c; |
284 | struct rndis_halt *halt; | 284 | struct rndis_halt *halt; |
285 | } u; | 285 | } u; |
286 | u32 tmp, *phym; | 286 | u32 tmp, phym_unspec, *phym; |
287 | int reply_len; | 287 | int reply_len; |
288 | unsigned char *bp; | 288 | unsigned char *bp; |
289 | 289 | ||
@@ -363,12 +363,15 @@ generic_rndis_bind(struct usbnet *dev, struct usb_interface *intf, int flags) | |||
363 | goto halt_fail_and_release; | 363 | goto halt_fail_and_release; |
364 | 364 | ||
365 | /* Check physical medium */ | 365 | /* Check physical medium */ |
366 | phym = NULL; | ||
366 | reply_len = sizeof *phym; | 367 | reply_len = sizeof *phym; |
367 | retval = rndis_query(dev, intf, u.buf, OID_GEN_PHYSICAL_MEDIUM, | 368 | retval = rndis_query(dev, intf, u.buf, OID_GEN_PHYSICAL_MEDIUM, |
368 | 0, (void **) &phym, &reply_len); | 369 | 0, (void **) &phym, &reply_len); |
369 | if (retval != 0) | 370 | if (retval != 0 || !phym) { |
370 | /* OID is optional so don't fail here. */ | 371 | /* OID is optional so don't fail here. */ |
371 | *phym = RNDIS_PHYSICAL_MEDIUM_UNSPECIFIED; | 372 | phym_unspec = RNDIS_PHYSICAL_MEDIUM_UNSPECIFIED; |
373 | phym = &phym_unspec; | ||
374 | } | ||
372 | if ((flags & FLAG_RNDIS_PHYM_WIRELESS) && | 375 | if ((flags & FLAG_RNDIS_PHYM_WIRELESS) && |
373 | *phym != RNDIS_PHYSICAL_MEDIUM_WIRELESS_LAN) { | 376 | *phym != RNDIS_PHYSICAL_MEDIUM_WIRELESS_LAN) { |
374 | if (netif_msg_probe(dev)) | 377 | if (netif_msg_probe(dev)) |