aboutsummaryrefslogtreecommitdiffstats
path: root/drivers
diff options
context:
space:
mode:
authorGrazvydas Ignotas <notasas@gmail.com>2010-03-11 10:45:26 -0500
committerJohn W. Linville <linville@tuxdriver.com>2010-03-16 15:20:25 -0400
commit3f60ebc9d6291863652d564bacc430629271e6a9 (patch)
treeab992d633968d5be9217ebcff705efad0bc2a7a9 /drivers
parentdee60269f0fe90927ce5095eef3a8723bbb9c53e (diff)
wl1251: fix potential crash
In case debugfs does not init for some reason (or is disabled on older kernels) driver does not allocate stats.fw_stats structure, but tries to clear it later and trips on a NULL pointer: Unable to handle kernel NULL pointer dereference at virtual address 00000000 PC is at __memzero+0x24/0x80 Backtrace: [<bf0ddb88>] (wl1251_debugfs_reset+0x0/0x30 [wl1251]) [<bf0d6a2c>] (wl1251_op_stop+0x0/0x12c [wl1251]) [<bf0bc228>] (ieee80211_stop_device+0x0/0x74 [mac80211]) [<bf0b0d10>] (ieee80211_stop+0x0/0x4ac [mac80211]) [<c02deeac>] (dev_close+0x0/0xb4) [<c02deac0>] (dev_change_flags+0x0/0x184) [<c031f478>] (devinet_ioctl+0x0/0x704) [<c0320720>] (inet_ioctl+0x0/0x100) Add a NULL pointer check to fix this. Signed-off-by: Grazvydas Ignotas <notasas@gmail.com> Acked-by: Kalle Valo <kalle.valo@iki.fi> Cc: stable@kernel.org Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'drivers')
-rw-r--r--drivers/net/wireless/wl12xx/wl1251_debugfs.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/net/wireless/wl12xx/wl1251_debugfs.c b/drivers/net/wireless/wl12xx/wl1251_debugfs.c
index 0ccba57fb9fb..05e4d68eb4cc 100644
--- a/drivers/net/wireless/wl12xx/wl1251_debugfs.c
+++ b/drivers/net/wireless/wl12xx/wl1251_debugfs.c
@@ -466,7 +466,8 @@ out:
466 466
467void wl1251_debugfs_reset(struct wl1251 *wl) 467void wl1251_debugfs_reset(struct wl1251 *wl)
468{ 468{
469 memset(wl->stats.fw_stats, 0, sizeof(*wl->stats.fw_stats)); 469 if (wl->stats.fw_stats != NULL)
470 memset(wl->stats.fw_stats, 0, sizeof(*wl->stats.fw_stats));
470 wl->stats.retry_count = 0; 471 wl->stats.retry_count = 0;
471 wl->stats.excessive_retries = 0; 472 wl->stats.excessive_retries = 0;
472} 473}