From b03a9db95a285e13a5e4f2913e9d22a84bf50cc6 Mon Sep 17 00:00:00 2001 From: Senthil Balasubramanian Date: Fri, 6 Mar 2009 11:24:09 +0530 Subject: ath9k: RX buffers may be accessed/freed even before initialized/alloced. accessing RXBUF list in ath_rx_cleanup may cause panic if ath_descdma_setup fails even before RXBUF list is initialized. Signed-off-by: Senthil Balasubramanian Signed-off-by: John W. Linville --- drivers/net/wireless/ath9k/main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers/net/wireless') diff --git a/drivers/net/wireless/ath9k/main.c b/drivers/net/wireless/ath9k/main.c index 4bc43db9ab2..7d9c060704b 100644 --- a/drivers/net/wireless/ath9k/main.c +++ b/drivers/net/wireless/ath9k/main.c @@ -1773,6 +1773,7 @@ int ath_descdma_setup(struct ath_softc *sc, struct ath_descdma *dd, DPRINTF(sc, ATH_DBG_CONFIG, "%s DMA: %u buffers %u desc/buf\n", name, nbuf, ndesc); + INIT_LIST_HEAD(head); /* ath_desc must be a multiple of DWORDs */ if ((sizeof(struct ath_desc) % 4) != 0) { DPRINTF(sc, ATH_DBG_FATAL, "ath_desc not DWORD aligned\n"); @@ -1823,7 +1824,6 @@ int ath_descdma_setup(struct ath_softc *sc, struct ath_descdma *dd, } dd->dd_bufptr = bf; - INIT_LIST_HEAD(head); for (i = 0; i < nbuf; i++, bf++, ds += ndesc) { bf->bf_desc = ds; bf->bf_daddr = DS2PHYS(dd, ds); -- cgit v1.2.3