mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-26 02:39:48 +00:00
wimax/i2400m: fix oops when the TX FIFO fills up due to a missing check
When the TX FIFO filled up and i2400m_tx_new() failed to allocate a new TX message header, a missing check for said condition was causing a kernel oops when trying to dereference a NULL i2400m->tx_msg pointer. Found and diagnosed by Cindy H. Kao. Signed-off-by: Inaky Perez-Gonzalez <inaky@linux.intel.com>
This commit is contained in:
parent
b4bd07e3b1
commit
59063afa0a
1 changed files with 2 additions and 0 deletions
|
@ -653,6 +653,8 @@ int i2400m_tx(struct i2400m *i2400m, const void *buf, size_t buf_len,
|
||||||
i2400m_tx_close(i2400m);
|
i2400m_tx_close(i2400m);
|
||||||
i2400m_tx_new(i2400m);
|
i2400m_tx_new(i2400m);
|
||||||
}
|
}
|
||||||
|
if (i2400m->tx_msg == NULL)
|
||||||
|
goto error_tx_new;
|
||||||
if (i2400m->tx_msg->size + padded_len > I2400M_TX_BUF_SIZE / 2) {
|
if (i2400m->tx_msg->size + padded_len > I2400M_TX_BUF_SIZE / 2) {
|
||||||
d_printf(2, dev, "TX: message too big, going new\n");
|
d_printf(2, dev, "TX: message too big, going new\n");
|
||||||
i2400m_tx_close(i2400m);
|
i2400m_tx_close(i2400m);
|
||||||
|
|
Loading…
Reference in a new issue