Skip to content

Commit

Permalink
wimax/i2400m: fix oops when the TX FIFO fills up due to a missing check
Browse files Browse the repository at this point in the history
When the TX FIFO filled up and i2400m_tx_new() failed to allocate a
new TX message header, a missing check for said condition was causing a
kernel oops when trying to dereference a NULL i2400m->tx_msg pointer.

Found and diagnosed by Cindy H. Kao.

Signed-off-by: Inaky Perez-Gonzalez <inaky@linux.intel.com>
  • Loading branch information
Inaky Perez-Gonzalez committed Jun 11, 2009
1 parent b4bd07e commit 59063af
Showing 1 changed file with 2 additions and 0 deletions.
2 changes: 2 additions & 0 deletions drivers/net/wimax/i2400m/tx.c
Original file line number Diff line number Diff line change
Expand Up @@ -653,6 +653,8 @@ int i2400m_tx(struct i2400m *i2400m, const void *buf, size_t buf_len,
i2400m_tx_close(i2400m);
i2400m_tx_new(i2400m);
}
if (i2400m->tx_msg == NULL)
goto error_tx_new;
if (i2400m->tx_msg->size + padded_len > I2400M_TX_BUF_SIZE / 2) {
d_printf(2, dev, "TX: message too big, going new\n");
i2400m_tx_close(i2400m);
Expand Down

0 comments on commit 59063af

Please sign in to comment.