lkml.org 
[lkml]   [2010]   [Aug]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[33/34] ssb: fix NULL ptr deref when pcihost_wrapper is used
    2.6.32-stable review patch.  If anyone has any objections, please let us know.

    ------------------

    From: Christoph Fritz <chf.fritz@googlemail.com>

    commit da1fdb02d9200ff28b6f3a380d21930335fe5429 upstream.

    Ethernet driver b44 does register ssb by it's pcihost_wrapper
    and doesn't set ssb_chipcommon. A check on this value
    introduced with commit d53cdbb94a52a920d5420ed64d986c3523a56743
    and ea2db495f92ad2cf3301623e60cb95b4062bc484 triggers:

    BUG: unable to handle kernel NULL pointer dereference at 00000010
    IP: [<c1266c36>] ssb_is_sprom_available+0x16/0x30

    Signed-off-by: Christoph Fritz <chf.fritz@googlemail.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>
    Cc: Larry Finger <Larry.Finger@lwfinger.net>
    Cc: Ben Hutchings <ben@decadent.org.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

    ---
    drivers/ssb/pci.c | 9 ++++++---
    drivers/ssb/sprom.c | 1 +
    2 files changed, 7 insertions(+), 3 deletions(-)

    --- a/drivers/ssb/pci.c
    +++ b/drivers/ssb/pci.c
    @@ -624,9 +624,12 @@ static int ssb_pci_sprom_get(struct ssb_
    ssb_printk(KERN_ERR PFX "No SPROM available!\n");
    return -ENODEV;
    }
    -
    - bus->sprom_offset = (bus->chipco.dev->id.revision < 31) ?
    - SSB_SPROM_BASE1 : SSB_SPROM_BASE31;
    + if (bus->chipco.dev) { /* can be unavailible! */
    + bus->sprom_offset = (bus->chipco.dev->id.revision < 31) ?
    + SSB_SPROM_BASE1 : SSB_SPROM_BASE31;
    + } else {
    + bus->sprom_offset = SSB_SPROM_BASE1;
    + }

    buf = kcalloc(SSB_SPROMSIZE_WORDS_R123, sizeof(u16), GFP_KERNEL);
    if (!buf)
    --- a/drivers/ssb/sprom.c
    +++ b/drivers/ssb/sprom.c
    @@ -188,6 +188,7 @@ bool ssb_is_sprom_available(struct ssb_b
    /* this routine differs from specs as we do not access SPROM directly
    on PCMCIA */
    if (bus->bustype == SSB_BUSTYPE_PCI &&
    + bus->chipco.dev && /* can be unavailible! */
    bus->chipco.dev->id.revision >= 31)
    return bus->chipco.capabilities & SSB_CHIPCO_CAP_SPROM;




    \
     
     \ /
      Last update: 2010-08-06 21:05    [W:0.021 / U:30.012 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site