- patches.fixes/0001-rt2x00-Remove-incorrect-led-blink.patch:
[opensuse:kernel-source.git] / patches.fixes / 0010-rt2x00-fix-a-possible-NULL-pointer-dereference.patch
1 Subject: [PATCH 10/18] rt2x00: fix a possible NULL pointer dereference
2
3 From: Gabor Juhos <juhosg@openwrt.org>
4 Git-commit: 7be081539e540517d5e1fcbf96b8080074afbf08
5 Patch-mainline: v3.3
6 References: bnc#774902
7
8 The 'rt2x00lib_probe_dev' function tries to
9 allocate the workqueue. If the allocation
10 fails, 'rt2x00_lib_remove_dev' is called on
11 the error path. Because 'rt2x00dev->workqueue'
12 is NULL in this case, the 'destroy_workqueue'
13 call will cause a NULL pointer dereference.
14
15 Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
16 Acked-by: Gertjan van Wingerde <gwingerde@gmail.com>
17 Acked-by: Ivo van Doorn <IvDoorn@gmail.com>
18 Signed-off-by: John W. Linville <linville@tuxdriver.com>
19 Acked-by: Chen, Chien-Chia <machen@suse.com>
20 ---
21  drivers/net/wireless/rt2x00/rt2x00dev.c |    3 ++-
22  1 files changed, 2 insertions(+), 1 deletions(-)
23
24 diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
25 index bdc2f6b..aa82d76 100644
26 --- a/drivers/net/wireless/rt2x00/rt2x00dev.c
27 +++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
28 @@ -1232,7 +1232,8 @@ void rt2x00lib_remove_dev(struct rt2x00_dev *rt2x00dev)
29                 cancel_work_sync(&rt2x00dev->rxdone_work);
30                 cancel_work_sync(&rt2x00dev->txdone_work);
31         }
32 -       destroy_workqueue(rt2x00dev->workqueue);
33 +       if (rt2x00dev->workqueue)
34 +               destroy_workqueue(rt2x00dev->workqueue);
35  
36         /*
37          * Free the tx status fifo.
38 -- 
39 1.6.0.2
40