* [PATCH] rt2x00: fix a possible NULL pointer dereference
@ 2012-02-16 19:44 Gabor Juhos
2012-02-16 19:59 ` [rt2x00-users] " Gertjan van Wingerde
2012-02-18 12:23 ` Ivo Van Doorn
0 siblings, 2 replies; 3+ messages in thread
From: Gabor Juhos @ 2012-02-16 19:44 UTC (permalink / raw)
To: John W. Linville; +Cc: linux-wireless, Ivo van Doorn, users, Gabor Juhos
The 'rt2x00lib_probe_dev' function tries to
allocate the workqueue. If the allocation
fails, 'rt2x00_lib_remove_dev' is called on
the error path. Because 'rt2x00dev->workqueue'
is NULL in this case, the 'destroy_workqueue'
call will cause a NULL pointer dereference.
Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
---
drivers/net/wireless/rt2x00/rt2x00dev.c | 3 ++-
1 files changed, 2 insertions(+), 1 deletions(-)
diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
index bae5b01..d62e64f 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dev.c
+++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
@@ -1232,7 +1232,8 @@ void rt2x00lib_remove_dev(struct rt2x00_dev *rt2x00dev)
cancel_work_sync(&rt2x00dev->rxdone_work);
cancel_work_sync(&rt2x00dev->txdone_work);
}
- destroy_workqueue(rt2x00dev->workqueue);
+ if (rt2x00dev->workqueue)
+ destroy_workqueue(rt2x00dev->workqueue);
/*
* Free the tx status fifo.
--
1.7.2.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [rt2x00-users] [PATCH] rt2x00: fix a possible NULL pointer dereference
2012-02-16 19:44 [PATCH] rt2x00: fix a possible NULL pointer dereference Gabor Juhos
@ 2012-02-16 19:59 ` Gertjan van Wingerde
2012-02-18 12:23 ` Ivo Van Doorn
1 sibling, 0 replies; 3+ messages in thread
From: Gertjan van Wingerde @ 2012-02-16 19:59 UTC (permalink / raw)
To: Gabor Juhos; +Cc: John W. Linville, Gabor Juhos, linux-wireless, users
On 16 feb. 2012, at 20:44, Gabor Juhos <juhosg@openwrt.org> wrote:
> The 'rt2x00lib_probe_dev' function tries to
> allocate the workqueue. If the allocation
> fails, 'rt2x00_lib_remove_dev' is called on
> the error path. Because 'rt2x00dev->workqueue'
> is NULL in this case, the 'destroy_workqueue'
> call will cause a NULL pointer dereference.
>
> Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
Good catch.
Acked-by: Gertjan van Wingerde <gwingerde@gmail.com>
> ---
> drivers/net/wireless/rt2x00/rt2x00dev.c | 3 ++-
> 1 files changed, 2 insertions(+), 1 deletions(-)
>
> diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
> index bae5b01..d62e64f 100644
> --- a/drivers/net/wireless/rt2x00/rt2x00dev.c
> +++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
> @@ -1232,7 +1232,8 @@ void rt2x00lib_remove_dev(struct rt2x00_dev *rt2x00dev)
> cancel_work_sync(&rt2x00dev->rxdone_work);
> cancel_work_sync(&rt2x00dev->txdone_work);
> }
> - destroy_workqueue(rt2x00dev->workqueue);
> + if (rt2x00dev->workqueue)
> + destroy_workqueue(rt2x00dev->workqueue);
>
> /*
> * Free the tx status fifo.
> --
> 1.7.2.1
>
>
> _______________________________________________
> users mailing list
> users@rt2x00.serialmonkey.com
> http://rt2x00.serialmonkey.com/mailman/listinfo/users_rt2x00.serialmonkey.com
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] rt2x00: fix a possible NULL pointer dereference
2012-02-16 19:44 [PATCH] rt2x00: fix a possible NULL pointer dereference Gabor Juhos
2012-02-16 19:59 ` [rt2x00-users] " Gertjan van Wingerde
@ 2012-02-18 12:23 ` Ivo Van Doorn
1 sibling, 0 replies; 3+ messages in thread
From: Ivo Van Doorn @ 2012-02-18 12:23 UTC (permalink / raw)
To: Gabor Juhos; +Cc: John W. Linville, linux-wireless, users
On Thu, Feb 16, 2012 at 8:44 PM, Gabor Juhos <juhosg@openwrt.org> wrote:
> The 'rt2x00lib_probe_dev' function tries to
> allocate the workqueue. If the allocation
> fails, 'rt2x00_lib_remove_dev' is called on
> the error path. Because 'rt2x00dev->workqueue'
> is NULL in this case, the 'destroy_workqueue'
> call will cause a NULL pointer dereference.
>
> Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
Acked-by: Ivo van Doorn <IvDoorn@gmail.com>
> ---
> drivers/net/wireless/rt2x00/rt2x00dev.c | 3 ++-
> 1 files changed, 2 insertions(+), 1 deletions(-)
>
> diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c
> index bae5b01..d62e64f 100644
> --- a/drivers/net/wireless/rt2x00/rt2x00dev.c
> +++ b/drivers/net/wireless/rt2x00/rt2x00dev.c
> @@ -1232,7 +1232,8 @@ void rt2x00lib_remove_dev(struct rt2x00_dev *rt2x00dev)
> cancel_work_sync(&rt2x00dev->rxdone_work);
> cancel_work_sync(&rt2x00dev->txdone_work);
> }
> - destroy_workqueue(rt2x00dev->workqueue);
> + if (rt2x00dev->workqueue)
> + destroy_workqueue(rt2x00dev->workqueue);
>
> /*
> * Free the tx status fifo.
> --
> 1.7.2.1
>
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2012-02-18 12:23 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2012-02-16 19:44 [PATCH] rt2x00: fix a possible NULL pointer dereference Gabor Juhos
2012-02-16 19:59 ` [rt2x00-users] " Gertjan van Wingerde
2012-02-18 12:23 ` Ivo Van Doorn
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.