Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a781cf94 authored by Reinette Chatre's avatar Reinette Chatre Committed by David S. Miller
Browse files

iwlwifi: fix possible read attempt on ucode that is not available 

This fixes a NULL pointer dereference that can occur when the
ucode is not loaded at the time __iwl_up is called.

The problem was reported at http://kerneloops.org/raw.php?rawid=2765&msgid=



Signed-off-by: default avatarReinette Chatre <reinette.chatre@intel.com>
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent 1e34a11d

drivers/net/wireless/iwlwifi/iwl3945-base.c

+5 −0
Original line number Diff line number Diff line
@@ -6342,6 +6342,11 @@ static int __iwl_up(struct iwl_priv *priv) 
		return 0;

	}



	if (!priv->ucode_data_backup.v_addr || !priv->ucode_data.v_addr) {

		IWL_ERROR("ucode not available for device bringup\n");

		return -EIO;

	}



	iwl_write32(priv, CSR_INT, 0xFFFFFFFF);



	rc = iwl_hw_nic_init(priv);

drivers/net/wireless/iwlwifi/iwl4965-base.c

+5 −0
Original line number Diff line number Diff line
@@ -6698,6 +6698,11 @@ static int __iwl_up(struct iwl_priv *priv) 
		return 0;

	}



	if (!priv->ucode_data_backup.v_addr || !priv->ucode_data.v_addr) {

		IWL_ERROR("ucode not available for device bringup\n");

		return -EIO;

	}



	iwl_write32(priv, CSR_INT, 0xFFFFFFFF);



	rc = iwl_hw_nic_init(priv);