diff options
| author | Shawn Joo(Seongho) <sjoo@nvidia.com> | 2012-03-08 17:46:26 +0900 |
|---|---|---|
| committer | Simone Willett <swillett@nvidia.com> | 2012-04-16 14:30:08 -0700 |
| commit | 7edf7e6fec91090c5b5b346557d449cd0810b62d (patch) | |
| tree | aaefc20894113442a6e3952a6bf73f06231b4d94 /drivers/net/usb | |
| parent | b3c06d9f3b9b2764edfa56816899b5d124af3c1f (diff) | |
net: usb: raw-ip: check invalid reference
before point reference check valid.
it prevents null point reference panic.
Bug 954883
Signed-off-by: Shawn Joo(Seongho) <sjoo@nvidia.com>
Reviewed-on: http://git-master/r/88781
(cherry picked from commit aac87c7d9c7cf7563bb79a29d517a6ffdba5874f)
Change-Id: Ica17acb6cc2a1a7ed03f41d8b569fdb6e2098fc9
Reviewed-on: http://git-master/r/96464
Reviewed-by: Simone Willett <swillett@nvidia.com>
Tested-by: Simone Willett <swillett@nvidia.com>
Diffstat (limited to 'drivers/net/usb')
| -rw-r--r-- | drivers/net/usb/raw_ip_net.c | 13 |
1 files changed, 9 insertions, 4 deletions
diff --git a/drivers/net/usb/raw_ip_net.c b/drivers/net/usb/raw_ip_net.c index 1b32a0c7ba12..b8cc5fd8a1bd 100644 --- a/drivers/net/usb/raw_ip_net.c +++ b/drivers/net/usb/raw_ip_net.c @@ -571,8 +571,8 @@ static int usb_net_raw_ip_rx_urb_submit(struct baseband_usb *usb) static void usb_net_raw_ip_rx_urb_comp(struct urb *urb) { - struct baseband_usb *usb = (struct baseband_usb *) urb->context; - int i = usb->baseband_index; + struct baseband_usb *usb; + int i; struct sk_buff *skb; unsigned char *dst; unsigned char ethernet_header[14] = { @@ -595,6 +595,8 @@ static void usb_net_raw_ip_rx_urb_comp(struct urb *urb) pr_err("no urb\n"); return; } + usb = (struct baseband_usb *)urb->context; + i = usb->baseband_index; switch (urb->status) { case 0: break; @@ -798,7 +800,9 @@ static void usb_net_raw_ip_tx_urb_work(struct work_struct *work) pr_debug("usb_net_raw_ip_tx_urb_work {\n"); /* check if tx urb(s) queued */ - if (!usb->usb.tx_urb && usb_anchor_empty(&usb->usb.tx_urb_deferred)) { + if (usb == NULL || + (!usb->usb.tx_urb && + usb_anchor_empty(&usb->usb.tx_urb_deferred))) { pr_debug("%s: nothing to do!\n", __func__); return; } @@ -858,7 +862,7 @@ static void usb_net_raw_ip_tx_urb_work(struct work_struct *work) static void usb_net_raw_ip_tx_urb_comp(struct urb *urb) { - struct baseband_usb *usb = (struct baseband_usb *) urb->context; + struct baseband_usb *usb; pr_debug("usb_net_raw_ip_tx_urb_comp {\n"); @@ -867,6 +871,7 @@ static void usb_net_raw_ip_tx_urb_comp(struct urb *urb) pr_err("no urb\n"); return; } + usb = (struct baseband_usb *)urb->context; switch (urb->status) { case 0: break; |