From: Senthil Balasubramanian Date: Fri, 6 Mar 2009 05:54:09 +0000 (+0530) Subject: ath9k: RX buffers may be accessed/freed even before initialized/alloced. X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=b03a9db95a285e13a5e4f2913e9d22a84bf50cc6;p=GitHub%2FLineageOS%2Fandroid_kernel_samsung_universal7580.git ath9k: RX buffers may be accessed/freed even before initialized/alloced. accessing RXBUF list in ath_rx_cleanup may cause panic if ath_descdma_setup fails even before RXBUF list is initialized. Signed-off-by: Senthil Balasubramanian Signed-off-by: John W. Linville --- diff --git a/drivers/net/wireless/ath9k/main.c b/drivers/net/wireless/ath9k/main.c index 4bc43db9ab2..7d9c060704b 100644 --- a/drivers/net/wireless/ath9k/main.c +++ b/drivers/net/wireless/ath9k/main.c @@ -1773,6 +1773,7 @@ int ath_descdma_setup(struct ath_softc *sc, struct ath_descdma *dd, DPRINTF(sc, ATH_DBG_CONFIG, "%s DMA: %u buffers %u desc/buf\n", name, nbuf, ndesc); + INIT_LIST_HEAD(head); /* ath_desc must be a multiple of DWORDs */ if ((sizeof(struct ath_desc) % 4) != 0) { DPRINTF(sc, ATH_DBG_FATAL, "ath_desc not DWORD aligned\n"); @@ -1823,7 +1824,6 @@ int ath_descdma_setup(struct ath_softc *sc, struct ath_descdma *dd, } dd->dd_bufptr = bf; - INIT_LIST_HEAD(head); for (i = 0; i < nbuf; i++, bf++, ds += ndesc) { bf->bf_desc = ds; bf->bf_daddr = DS2PHYS(dd, ds);