summaryrefslogtreecommitdiffstats
path: root/drivers/atm
diff options
context:
space:
mode:
authorTong Zhang <ztong0001@gmail.com>2021-03-08 04:25:30 +0100
committerDavid S. Miller <davem@davemloft.net>2021-03-09 00:16:30 +0100
commit4416e98594dc04590ebc498fc4e530009535c511 (patch)
tree6c24c4f105112d7a2b9105f65204ef22c7f2dd6e /drivers/atm
parentatm: uPD98402: fix incorrect allocation (diff)
downloadlinux-4416e98594dc04590ebc498fc4e530009535c511.tar.xz
linux-4416e98594dc04590ebc498fc4e530009535c511.zip
atm: idt77252: fix null-ptr-dereference
this one is similar to the phy_data allocation fix in uPD98402, the driver allocate the idt77105_priv and store to dev_data but later dereference using dev->dev_data, which will cause null-ptr-dereference. fix this issue by changing dev_data to phy_data so that PRIV(dev) can work correctly. Signed-off-by: Tong Zhang <ztong0001@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/atm')
-rw-r--r--drivers/atm/idt77105.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/atm/idt77105.c b/drivers/atm/idt77105.c
index 3c081b6171a8..bfca7b8a6f31 100644
--- a/drivers/atm/idt77105.c
+++ b/drivers/atm/idt77105.c
@@ -262,7 +262,7 @@ static int idt77105_start(struct atm_dev *dev)
{
unsigned long flags;
- if (!(dev->dev_data = kmalloc(sizeof(struct idt77105_priv),GFP_KERNEL)))
+ if (!(dev->phy_data = kmalloc(sizeof(struct idt77105_priv),GFP_KERNEL)))
return -ENOMEM;
PRIV(dev)->dev = dev;
spin_lock_irqsave(&idt77105_priv_lock, flags);
@@ -337,7 +337,7 @@ static int idt77105_stop(struct atm_dev *dev)
else
idt77105_all = walk->next;
dev->phy = NULL;
- dev->dev_data = NULL;
+ dev->phy_data = NULL;
kfree(walk);
break;
}