Linux 2.6.25.8

[thirdparty/kernel/stable-queue.git] / releases / 2.6.25.8 / b43-fix-possible-null-pointer-dereference-in-dma-code.patch

From stable-bounces@linux.kernel.org Sat Jun 14 14:46:55 2008
From: Michael Buesch <mb@bu3sch.de>
Date: Sat, 14 Jun 2008 22:57:55 +0200
Subject: b43: Fix possible NULL pointer dereference in DMA code
To: stable@kernel.org
Cc: linux-wireless@vger.kernel.org, bcm43xx-dev@lists.berlios.de
Message-ID: <200806142257.55946.mb@bu3sch.de>
Content-Disposition: inline

From: Michael Buesch <mb@bu3sch.de>

a cut-down version of commit 028118a5f09a9c807e6b43e2231efdff9f224c74 upstream

This fixes a possible NULL pointer dereference in an error path of the
DMA allocation error checking code. In case the DMA allocation address is invalid,
the dev pointer is dereferenced for unmapping of the buffer.

Reported-by: Miles Lane <miles.lane@gmail.com>
Signed-off-by: Michael Buesch <mb@bu3sch.de>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
 drivers/net/wireless/b43/dma.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/net/wireless/b43/dma.c
+++ b/drivers/net/wireless/b43/dma.c
@@ -850,6 +850,7 @@ struct b43_dmaring *b43_setup_dmaring(st
 	if (!ring)
 		goto out;
 	ring->type = type;
+	ring->dev = dev;
 
 	nr_slots = B43_RXRING_SLOTS;
 	if (for_tx)
@@ -901,7 +902,6 @@ struct b43_dmaring *b43_setup_dmaring(st
 				 DMA_TO_DEVICE);
 	}
 
-	ring->dev = dev;
 	ring->nr_slots = nr_slots;
 	ring->mmio_base = b43_dmacontroller_base(type, controller_index);
 	ring->index = controller_index;