]> git.karo-electronics.de Git - karo-tx-linux.git/commit
iwl3945: fix possible il->txq NULL pointer dereference in delayed works
authorStanislaw Gruszka <sgruszka@redhat.com>
Thu, 8 Mar 2012 12:16:01 +0000 (13:16 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 23 Mar 2012 18:20:52 +0000 (11:20 -0700)
commit8290924361675d411266b890ab3b5964dc8e7255
tree262a98dcbd6ac7b56de404a06405e259a544774e
parent97490c46fea06ecf95f989789e72c54fba2e2584
iwl3945: fix possible il->txq NULL pointer dereference in delayed works

commit 210787e82a0ac1ffb5d7be1c796f0c51050849ad upstream.

On il3945_down procedure we free tx queue data and nullify il->txq
pointer. After that we drop mutex and then cancel delayed works. There
is possibility, that after drooping mutex and before the cancel, some
delayed work will start and crash while trying to send commands to
the device. For example, here is reported crash in
il3945_bg_reg_txpower_periodic():
https://bugzilla.kernel.org/show_bug.cgi?id=42766#c10

Patch fix problem by adding il->txq check on works that send commands,
hence utilize tx queue.

Reported-by: Clemens Eisserer <linuxhippy@gmail.com>
Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
drivers/net/wireless/iwlegacy/iwl-3945.c
drivers/net/wireless/iwlegacy/iwl3945-base.c