Techwizz/kernel-fxtec-pro1x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

ssb: fix NULL ptr deref when pcihost_wrapper is used

Browse source 
Ethernet driver b44 does register ssb by it's pcihost_wrapper
and doesn't set ssb_chipcommon. A check on this value
introduced with commit d53cdbb94a
and ea2db495f9 triggers:

BUG: unable to handle kernel NULL pointer dereference at 00000010
IP: [<c1266c36>] ssb_is_sprom_available+0x16/0x30

Signed-off-by: Christoph Fritz <chf.fritz@googlemail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
This commit is contained in:
Christoph Fritz 2010-05-28 10:45:59 +02:00 committed by John W. Linville
parent 368a07d26a
commit da1fdb02d9
2 changed files with 7 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
drivers/ssb/pci.c
View file

@ -625,9 +625,12 @@ static int ssb_pci_sprom_get(struct ssb_bus *bus,
ssb_printk(KERN_ERR PFX "No SPROM available!\n"); ssb_printk(KERN_ERR PFX "No SPROM available!\n");
return -ENODEV; return -ENODEV;
} }
if (bus->chipco.dev) { /* can be unavailible! */
bus->sprom_offset = (bus->chipco.dev->id.revision < 31) ? bus->sprom_offset = (bus->chipco.dev->id.revision < 31) ?
SSB_SPROM_BASE1 : SSB_SPROM_BASE31; SSB_SPROM_BASE1 : SSB_SPROM_BASE31;
} else {
bus->sprom_offset = SSB_SPROM_BASE1;
}
buf = kcalloc(SSB_SPROMSIZE_WORDS_R123, sizeof(u16), GFP_KERNEL); buf = kcalloc(SSB_SPROMSIZE_WORDS_R123, sizeof(u16), GFP_KERNEL);
if (!buf) if (!buf)

1
drivers/ssb/sprom.c
View file

@ -185,6 +185,7 @@ bool ssb_is_sprom_available(struct ssb_bus *bus)
/* this routine differs from specs as we do not access SPROM directly /* this routine differs from specs as we do not access SPROM directly
on PCMCIA */ on PCMCIA */
if (bus->bustype == SSB_BUSTYPE_PCI && if (bus->bustype == SSB_BUSTYPE_PCI &&
bus->chipco.dev && /* can be unavailible! */
bus->chipco.dev->id.revision >= 31) bus->chipco.dev->id.revision >= 31)
return bus->chipco.capabilities & SSB_CHIPCO_CAP_SPROM; return bus->chipco.capabilities & SSB_CHIPCO_CAP_SPROM;