diff options
| author | Jussi Kivilinna <jussi.kivilinna@mbnet.fi> | 2008-03-23 11:45:44 +0100 |
|---|---|---|
| committer | Jeff Garzik <jeff@garzik.org> | 2008-03-26 04:42:06 +0100 |
| commit | 9f5e60dd5ffca938da4cabc197af8b9405b5512e (patch) | |
| tree | e6764734215126ccbcac1c7e52b0e48f117df7c0 /drivers/net/usb/rndis_host.c | |
| parent | cxgb3: Fix lockdep problems with sge.reg_lock (diff) | |
| download | linux-9f5e60dd5ffca938da4cabc197af8b9405b5512e.tar.xz linux-9f5e60dd5ffca938da4cabc197af8b9405b5512e.zip | |
rndis_host: fix oops when query for OID_GEN_PHYSICAL_MEDIUM fails
When query for OID_GEN_PHYSICAL_MEDIUM fails, uninitialized pointer
'phym' is being accessed in generic_rndis_bind(), resulting OOPS.
Patch fixes phym to be initialized and setup correctly when
rndis_query() for physical medium fails.
Bug was introduced by following commit:
commit 039ee17d1baabaa21783a0d5ab3e8c6d8c794bdf
Author: Jussi Kivilinna <jussi.kivilinna@mbnet.fi>
Date: Sun Jan 27 23:34:33 2008 +0200
Reported-by: Dmitri Monakhov <dmonakhov@openvz.org>
Signed-off-by: Jussi Kivilinna <jussi.kivilinna@mbnet.fi>
Acked-by: David Brownell <dbrownell@users.sourceforge.net>
Signed-off-by: Jeff Garzik <jeff@garzik.org>
Diffstat (limited to 'drivers/net/usb/rndis_host.c')
| -rw-r--r-- | drivers/net/usb/rndis_host.c | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/drivers/net/usb/rndis_host.c b/drivers/net/usb/rndis_host.c index 727547a28992..369c731114b3 100644 --- a/drivers/net/usb/rndis_host.c +++ b/drivers/net/usb/rndis_host.c @@ -283,7 +283,7 @@ generic_rndis_bind(struct usbnet *dev, struct usb_interface *intf, int flags) struct rndis_set_c *set_c; struct rndis_halt *halt; } u; - u32 tmp, *phym; + u32 tmp, phym_unspec, *phym; int reply_len; unsigned char *bp; @@ -363,12 +363,15 @@ generic_rndis_bind(struct usbnet *dev, struct usb_interface *intf, int flags) goto halt_fail_and_release; /* Check physical medium */ + phym = NULL; reply_len = sizeof *phym; retval = rndis_query(dev, intf, u.buf, OID_GEN_PHYSICAL_MEDIUM, 0, (void **) &phym, &reply_len); - if (retval != 0) + if (retval != 0 || !phym) { /* OID is optional so don't fail here. */ - *phym = RNDIS_PHYSICAL_MEDIUM_UNSPECIFIED; + phym_unspec = RNDIS_PHYSICAL_MEDIUM_UNSPECIFIED; + phym = &phym_unspec; + } if ((flags & FLAG_RNDIS_PHYM_WIRELESS) && *phym != RNDIS_PHYSICAL_MEDIUM_WIRELESS_LAN) { if (netif_msg_probe(dev)) |