Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f859f508 authored by Tong Zhang's avatar Tong Zhang Committed by Greg Kroah-Hartman
Browse files

atm: idt77252: fix null-ptr-dereference 



[ Upstream commit 4416e98594dc04590ebc498fc4e530009535c511 ]

this one is similar to the phy_data allocation fix in uPD98402, the
driver allocate the idt77105_priv and store to dev_data but later
dereference using dev->dev_data, which will cause null-ptr-dereference.

fix this issue by changing dev_data to phy_data so that PRIV(dev) can
work correctly.

Signed-off-by: default avatarTong Zhang <ztong0001@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent e3c084e6

drivers/atm/idt77105.c

+2 −2
Original line number Diff line number Diff line
@@ -261,7 +261,7 @@ static int idt77105_start(struct atm_dev *dev) 
{

	unsigned long flags;



	if (!(dev->dev_data = kmalloc(sizeof(struct idt77105_priv),GFP_KERNEL)))

	if (!(dev->phy_data = kmalloc(sizeof(struct idt77105_priv),GFP_KERNEL)))

		return -ENOMEM;

	PRIV(dev)->dev = dev;

	spin_lock_irqsave(&idt77105_priv_lock, flags);
@@ -336,7 +336,7 @@ static int idt77105_stop(struct atm_dev *dev) 
                else

                    idt77105_all = walk->next;

	        dev->phy = NULL;

                dev->dev_data = NULL;

                dev->phy_data = NULL;

                kfree(walk);

                break;

            }