diff options
Diffstat (limited to 'recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.13/0008-iwl3945-fix-possible-il-txq-NULL-pointer-dereference.patch')
-rw-r--r-- | recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.13/0008-iwl3945-fix-possible-il-txq-NULL-pointer-dereference.patch | 63 |
1 files changed, 63 insertions, 0 deletions
diff --git a/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.13/0008-iwl3945-fix-possible-il-txq-NULL-pointer-dereference.patch b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.13/0008-iwl3945-fix-possible-il-txq-NULL-pointer-dereference.patch new file mode 100644 index 00000000..07ecf541 --- /dev/null +++ b/recipes-kernel/linux/linux-ti33x-psp-3.2/3.2.13/0008-iwl3945-fix-possible-il-txq-NULL-pointer-dereference.patch | |||
@@ -0,0 +1,63 @@ | |||
1 | From 50090beeab6611dbfccd8565bf6a6a97beddc6ee Mon Sep 17 00:00:00 2001 | ||
2 | From: Stanislaw Gruszka <sgruszka@redhat.com> | ||
3 | Date: Thu, 8 Mar 2012 13:16:01 +0100 | ||
4 | Subject: [PATCH 08/10] iwl3945: fix possible il->txq NULL pointer dereference | ||
5 | in delayed works | ||
6 | |||
7 | commit 210787e82a0ac1ffb5d7be1c796f0c51050849ad upstream. | ||
8 | |||
9 | On il3945_down procedure we free tx queue data and nullify il->txq | ||
10 | pointer. After that we drop mutex and then cancel delayed works. There | ||
11 | is possibility, that after drooping mutex and before the cancel, some | ||
12 | delayed work will start and crash while trying to send commands to | ||
13 | the device. For example, here is reported crash in | ||
14 | il3945_bg_reg_txpower_periodic(): | ||
15 | https://bugzilla.kernel.org/show_bug.cgi?id=42766#c10 | ||
16 | |||
17 | Patch fix problem by adding il->txq check on works that send commands, | ||
18 | hence utilize tx queue. | ||
19 | |||
20 | Reported-by: Clemens Eisserer <linuxhippy@gmail.com> | ||
21 | Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com> | ||
22 | Signed-off-by: John W. Linville <linville@tuxdriver.com> | ||
23 | --- | ||
24 | drivers/net/wireless/iwlegacy/iwl-3945.c | 7 ++++--- | ||
25 | drivers/net/wireless/iwlegacy/iwl3945-base.c | 2 +- | ||
26 | 2 files changed, 5 insertions(+), 4 deletions(-) | ||
27 | |||
28 | diff --git a/drivers/net/wireless/iwlegacy/iwl-3945.c b/drivers/net/wireless/iwlegacy/iwl-3945.c | ||
29 | index f7c0a74..7d1aa7c 100644 | ||
30 | --- a/drivers/net/wireless/iwlegacy/iwl-3945.c | ||
31 | +++ b/drivers/net/wireless/iwlegacy/iwl-3945.c | ||
32 | @@ -1870,11 +1870,12 @@ static void iwl3945_bg_reg_txpower_periodic(struct work_struct *work) | ||
33 | struct iwl_priv *priv = container_of(work, struct iwl_priv, | ||
34 | _3945.thermal_periodic.work); | ||
35 | |||
36 | - if (test_bit(STATUS_EXIT_PENDING, &priv->status)) | ||
37 | - return; | ||
38 | - | ||
39 | mutex_lock(&priv->mutex); | ||
40 | + if (test_bit(STATUS_EXIT_PENDING, &priv->status) || priv->txq == NULL) | ||
41 | + goto out; | ||
42 | + | ||
43 | iwl3945_reg_txpower_periodic(priv); | ||
44 | +out: | ||
45 | mutex_unlock(&priv->mutex); | ||
46 | } | ||
47 | |||
48 | diff --git a/drivers/net/wireless/iwlegacy/iwl3945-base.c b/drivers/net/wireless/iwlegacy/iwl3945-base.c | ||
49 | index 05f2ad1..b3d9f3f 100644 | ||
50 | --- a/drivers/net/wireless/iwlegacy/iwl3945-base.c | ||
51 | +++ b/drivers/net/wireless/iwlegacy/iwl3945-base.c | ||
52 | @@ -2513,7 +2513,7 @@ static void iwl3945_bg_alive_start(struct work_struct *data) | ||
53 | container_of(data, struct iwl_priv, alive_start.work); | ||
54 | |||
55 | mutex_lock(&priv->mutex); | ||
56 | - if (test_bit(STATUS_EXIT_PENDING, &priv->status)) | ||
57 | + if (test_bit(STATUS_EXIT_PENDING, &priv->status) || priv->txq == NULL) | ||
58 | goto out; | ||
59 | |||
60 | iwl3945_alive_start(priv); | ||
61 | -- | ||
62 | 1.7.9.4 | ||
63 | |||