summaryrefslogtreecommitdiff
path: root/drivers
diff options
context:
space:
mode:
authorInaky Perez-Gonzalez <inaky@linux.intel.com>2009-05-27 12:04:40 +0400
committerInaky Perez-Gonzalez <inaky@linux.intel.com>2009-06-11 14:30:22 +0400
commit59063afa0afabc68d2b6ca0d106da9165e1c7d39 (patch)
tree4fda5f5feaa11a8d311661cd0630d06ad29c8aa7 /drivers
parentb4bd07e3b13e3c848c7678c4fc870cca1d22ed4e (diff)
downloadlinux-59063afa0afabc68d2b6ca0d106da9165e1c7d39.tar.xz
wimax/i2400m: fix oops when the TX FIFO fills up due to a missing check
When the TX FIFO filled up and i2400m_tx_new() failed to allocate a new TX message header, a missing check for said condition was causing a kernel oops when trying to dereference a NULL i2400m->tx_msg pointer. Found and diagnosed by Cindy H. Kao. Signed-off-by: Inaky Perez-Gonzalez <inaky@linux.intel.com>
Diffstat (limited to 'drivers')
-rw-r--r--drivers/net/wimax/i2400m/tx.c2
1 files changed, 2 insertions, 0 deletions
diff --git a/drivers/net/wimax/i2400m/tx.c b/drivers/net/wimax/i2400m/tx.c
index 4295dcf96ee2..fa16ccf8e26a 100644
--- a/drivers/net/wimax/i2400m/tx.c
+++ b/drivers/net/wimax/i2400m/tx.c
@@ -653,6 +653,8 @@ try_new:
i2400m_tx_close(i2400m);
i2400m_tx_new(i2400m);
}
+ if (i2400m->tx_msg == NULL)
+ goto error_tx_new;
if (i2400m->tx_msg->size + padded_len > I2400M_TX_BUF_SIZE / 2) {
d_printf(2, dev, "TX: message too big, going new\n");
i2400m_tx_close(i2400m);