aboutsummaryrefslogtreecommitdiff
path: root/drivers/net/wireless
diff options
context:
space:
mode:
authorReinette Chatre <reinette.chatre@intel.com>2008-01-21 10:08:31 -0800
committerDavid S. Miller <davem@davemloft.net>2008-01-23 03:11:41 -0800
commita781cf94e6dcc09bf13e548298185d916d9ff3c8 (patch)
treea4aa53c18545ed3f9e4ab0ff6bb7184b37ee6c01 /drivers/net/wireless
parent1e34a11d55c9437775367d72ad03f9af99e78bd0 (diff)
iwlwifi: fix possible read attempt on ucode that is not available
This fixes a NULL pointer dereference that can occur when the ucode is not loaded at the time __iwl_up is called. The problem was reported at http://kerneloops.org/raw.php?rawid=2765&msgid= Signed-off-by: Reinette Chatre <reinette.chatre@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'drivers/net/wireless')
-rw-r--r--drivers/net/wireless/iwlwifi/iwl3945-base.c5
-rw-r--r--drivers/net/wireless/iwlwifi/iwl4965-base.c5
2 files changed, 10 insertions, 0 deletions
diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
index 1a6b0e0edf6..0b3ec7e4d93 100644
--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -6342,6 +6342,11 @@ static int __iwl_up(struct iwl_priv *priv)
return 0;
}
+ if (!priv->ucode_data_backup.v_addr || !priv->ucode_data.v_addr) {
+ IWL_ERROR("ucode not available for device bringup\n");
+ return -EIO;
+ }
+
iwl_write32(priv, CSR_INT, 0xFFFFFFFF);
rc = iwl_hw_nic_init(priv);
diff --git a/drivers/net/wireless/iwlwifi/iwl4965-base.c b/drivers/net/wireless/iwlwifi/iwl4965-base.c
index 6cd57c22063..15a45f47171 100644
--- a/drivers/net/wireless/iwlwifi/iwl4965-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl4965-base.c
@@ -6698,6 +6698,11 @@ static int __iwl_up(struct iwl_priv *priv)
return 0;
}
+ if (!priv->ucode_data_backup.v_addr || !priv->ucode_data.v_addr) {
+ IWL_ERROR("ucode not available for device bringup\n");
+ return -EIO;
+ }
+
iwl_write32(priv, CSR_INT, 0xFFFFFFFF);
rc = iwl_hw_nic_init(priv);