diff options
| author | John W. Linville <linville@tuxdriver.com> | 2010-08-24 15:27:34 -0400 |
|---|---|---|
| committer | Paul Gortmaker <paul.gortmaker@windriver.com> | 2011-01-06 18:07:48 -0500 |
| commit | 4bc2b2fce7a6de8df10442c73600327b6b999706 (patch) | |
| tree | 7a802691e60d4830f418e8ef991d0f70f184e9cc /drivers/net | |
| parent | 4cd69d4ef59656cc77f70284ec22ecc60c39b0c3 (diff) | |
| download | linux-stable-4bc2b2fce7a6de8df10442c73600327b6b999706.tar.gz linux-stable-4bc2b2fce7a6de8df10442c73600327b6b999706.tar.bz2 linux-stable-4bc2b2fce7a6de8df10442c73600327b6b999706.zip | |
ath5k: check return value of ieee80211_get_tx_rate
commit d8e1ba76d619dbc0be8fbeee4e6c683b5c812d3a upstream.
This avoids a NULL pointer dereference as reported here:
https://bugzilla.redhat.com/show_bug.cgi?id=625889
When the WARN condition is hit in ieee80211_get_tx_rate, it will return
NULL. So, we need to check the return value and avoid dereferencing it
in that case.
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Acked-by: Bob Copeland <me@bobcopeland.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
Diffstat (limited to 'drivers/net')
| -rw-r--r-- | drivers/net/wireless/ath/ath5k/base.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/drivers/net/wireless/ath/ath5k/base.c b/drivers/net/wireless/ath/ath5k/base.c index db8416966670..61023e96649e 100644 --- a/drivers/net/wireless/ath/ath5k/base.c +++ b/drivers/net/wireless/ath/ath5k/base.c @@ -1316,6 +1316,10 @@ ath5k_txbuf_setup(struct ath5k_softc *sc, struct ath5k_buf *bf, PCI_DMA_TODEVICE); rate = ieee80211_get_tx_rate(sc->hw, info); + if (!rate) { + ret = -EINVAL; + goto err_unmap; + } if (info->flags & IEEE80211_TX_CTL_NO_ACK) flags |= AR5K_TXDESC_NOACK; |