rtlwifi: rtl8192cu: Fix NULL dereference BUG when using new_id

When the new_id entry in /sysfs is used for a foreign USB device, rtlwifi
BUGS with a NULL pointer dereference because the per-driver configuration
data is not available. The probe function has been restructured as
suggested by Ben Hutchings <bhutchings@solarflare.com>.

Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Cc: Stable <stable@vger.kernel.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
index d9e659f92767f8e4114df8339580f0d370a24b0b..577c0dca21edfcc4e34a2c44a2ec4ff8fc977bdd 100644 (file)
--- a/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192cu/sw.c
@@ -363,9 +363,15 @@ static struct usb_device_id rtl8192c_usb_ids[] = {
 
 MODULE_DEVICE_TABLE(usb, rtl8192c_usb_ids);
 
+static int rtl8192cu_probe(struct usb_interface *intf,
+                          const struct usb_device_id *id)
+{
+       return rtl_usb_probe(intf, id, &rtl92cu_hal_cfg);
+}
+
 static struct usb_driver rtl8192cu_driver = {
        .name = "rtl8192cu",
-       .probe = rtl_usb_probe,
+       .probe = rtl8192cu_probe,
        .disconnect = rtl_usb_disconnect,
        .id_table = rtl8192c_usb_ids,
 

diff --git a/drivers/net/wireless/rtlwifi/usb.c b/drivers/net/wireless/rtlwifi/usb.c
index af5423cc5b0fd9adb44e8a3bef9d076a7abde839..80730c72e0d6d07973a6434cc4224d227159b5a6 100644 (file)
--- a/drivers/net/wireless/rtlwifi/usb.c
+++ b/drivers/net/wireless/rtlwifi/usb.c
@@ -937,7 +937,8 @@ static struct rtl_intf_ops rtl_usb_ops = {
 };
 
 int rtl_usb_probe(struct usb_interface *intf,
-                       const struct usb_device_id *id)
+                 const struct usb_device_id *id,
+                 struct rtl_hal_cfg *rtl_hal_cfg)
 {
        int err;
        struct ieee80211_hw *hw = NULL;
@@ -972,7 +973,7 @@ int rtl_usb_probe(struct usb_interface *intf,
        usb_set_intfdata(intf, hw);
        /* init cfg & intf_ops */
        rtlpriv->rtlhal.interface = INTF_USB;
-       rtlpriv->cfg = (struct rtl_hal_cfg *)(id->driver_info);
+       rtlpriv->cfg = rtl_hal_cfg;
        rtlpriv->intf_ops = &rtl_usb_ops;
        rtl_dbgp_flag_init(hw);
        /* Init IO handler */

diff --git a/drivers/net/wireless/rtlwifi/usb.h b/drivers/net/wireless/rtlwifi/usb.h
index 5235136f6dd2c0ec194a9d7595c9b65b21e19ec2..fb986f98d1dfabf0eae94bb539f26f0a20b91b8f 100644 (file)
--- a/drivers/net/wireless/rtlwifi/usb.h
+++ b/drivers/net/wireless/rtlwifi/usb.h
@@ -157,7 +157,8 @@ struct rtl_usb_priv {
 
 
 int rtl_usb_probe(struct usb_interface *intf,
-                           const struct usb_device_id *id);
+                 const struct usb_device_id *id,
+                 struct rtl_hal_cfg *rtl92cu_hal_cfg);
 void rtl_usb_disconnect(struct usb_interface *intf);
 int rtl_usb_suspend(struct usb_interface *pusb_intf, pm_message_t message);
 int rtl_usb_resume(struct usb_interface *pusb_intf);