From 38d10b5fd8eb81e10b9572359c90e627432217d1 Mon Sep 17 00:00:00 2001 From: Michael Buesch Date: Sat, 14 Jun 2008 22:57:55 +0200 Subject: [PATCH] b43: Fix possible NULL pointer dereference in DMA code a cut-down version of commit 028118a5f09a9c807e6b43e2231efdff9f224c74 upstream This fixes a possible NULL pointer dereference in an error path of the DMA allocation error checking code. In case the DMA allocation address is invalid, the dev pointer is dereferenced for unmapping of the buffer. Reported-by: Miles Lane Signed-off-by: Michael Buesch Signed-off-by: John W. Linville Signed-off-by: Greg Kroah-Hartman --- drivers/net/wireless/b43/dma.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/wireless/b43/dma.c b/drivers/net/wireless/b43/dma.c index 4ec191556f23..f74dba292b38 100644 --- a/drivers/net/wireless/b43/dma.c +++ b/drivers/net/wireless/b43/dma.c @@ -850,6 +850,7 @@ struct b43_dmaring *b43_setup_dmaring(struct b43_wldev *dev, if (!ring) goto out; ring->type = type; + ring->dev = dev; nr_slots = B43_RXRING_SLOTS; if (for_tx) @@ -901,7 +902,6 @@ struct b43_dmaring *b43_setup_dmaring(struct b43_wldev *dev, DMA_TO_DEVICE); } - ring->dev = dev; ring->nr_slots = nr_slots; ring->mmio_base = b43_dmacontroller_base(type, controller_index); ring->index = controller_index; -- 2.39.5