Prechádzať zdrojové kódy

mac80211: rt2x00: fix crash on release_firmware

Fix crash due to passing invalid r2x00dev->eeprom_file pointer to
release_firmware(). Since we copy eeprom data with EEPROM_SIZE
in rt2800_read_eeprom() we can use eeprom_file->size as marker
if the file was crated by request_firmware().

Acked-by: Kristian Evensen <[email protected]>
Signed-off-by: Stanislaw Gruszka <[email protected]>
Stanislaw Gruszka 6 rokov pred
rodič
commit
426ffc563a

+ 3 - 2
package/kernel/mac80211/patches/rt2x00/602-rt2x00-introduce-rt2x00eeprom.patch

@@ -152,7 +152,7 @@
  
 --- /dev/null
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2x00eeprom.c
-@@ -0,0 +1,105 @@
+@@ -0,0 +1,106 @@
 +/*
 +	Copyright (C) 2004 - 2009 Ivo van Doorn <[email protected]>
 +	Copyright (C) 2004 - 2009 Gertjan van Wingerde <[email protected]>
@@ -255,7 +255,8 @@
 +
 +void rt2x00lib_free_eeprom_file(struct rt2x00_dev *rt2x00dev)
 +{
-+	release_firmware(rt2x00dev->eeprom_file);
++	if (rt2x00dev->eeprom_file && rt2x00dev->eeprom_file->size)
++		release_firmware(rt2x00dev->eeprom_file);
 +	rt2x00dev->eeprom_file = NULL;
 +}
 --- a/drivers/net/wireless/ralink/rt2x00/rt2x00lib.h

+ 2 - 3
package/kernel/mac80211/patches/rt2x00/604-rt2x00-load-eeprom-on-SoC-from-a-mtd-device-defines-.patch

@@ -22,7 +22,7 @@ Signed-off-by: John Crispin <[email protected]>
  	  Supported chips: RT2880, RT3050, RT3052, RT3350, RT3352.
 --- a/drivers/net/wireless/ralink/rt2x00/rt2x00eeprom.c
 +++ b/drivers/net/wireless/ralink/rt2x00/rt2x00eeprom.c
-@@ -26,11 +26,73 @@
+@@ -26,11 +26,72 @@
  
  #include <linux/kernel.h>
  #include <linux/module.h>
@@ -84,7 +84,6 @@ Signed-off-by: John Crispin <[email protected]>
 +			rt2x00dev->eeprom[i] = swab16(rt2x00dev->eeprom[i]);
 +
 +	rt2x00dev->eeprom_file = &mtd_fw;
-+	mtd_fw.size = len;
 +	mtd_fw.data = (const u8 *) rt2x00dev->eeprom;
 +
 +	dev_info(rt2x00dev->dev, "loaded eeprom from mtd device \"%s\"\n", part);
@@ -96,7 +95,7 @@ Signed-off-by: John Crispin <[email protected]>
  static const char *
  rt2x00lib_get_eeprom_file_name(struct rt2x00_dev *rt2x00dev)
  {
-@@ -58,6 +120,9 @@ static int rt2x00lib_request_eeprom_file
+@@ -58,6 +119,9 @@ static int rt2x00lib_request_eeprom_file
  	const char *ee_name;
  	int retval;