iwlwifi: fix possible read attempt on ucode that is not available

This fixes a NULL pointer dereference that can occur when the
ucode is not loaded at the time __iwl_up is called.

The problem was reported at http://kerneloops.org/raw.php?rawid=2765&msgid=

Signed-off-by: Reinette Chatre <reinette.chatre@intel.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
index 1a6b0e0edf6f026d8f3c98bc1e1cd454936ef4c0..0b3ec7e4d93b30e4a78d7f5f674aafb4ba69a462 100644 (file)
--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -6342,6 +6342,11 @@ static int __iwl_up(struct iwl_priv *priv)
                return 0;
        }
 
+       if (!priv->ucode_data_backup.v_addr || !priv->ucode_data.v_addr) {
+               IWL_ERROR("ucode not available for device bringup\n");
+               return -EIO;
+       }
+
        iwl_write32(priv, CSR_INT, 0xFFFFFFFF);
 
        rc = iwl_hw_nic_init(priv);

diff --git a/drivers/net/wireless/iwlwifi/iwl4965-base.c b/drivers/net/wireless/iwlwifi/iwl4965-base.c
index 6cd57c220631919fd33ced7cdc01a94b84502c0b..15a45f4717104300f201866ab535a52ad35c7133 100644 (file)
--- a/drivers/net/wireless/iwlwifi/iwl4965-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl4965-base.c
@@ -6698,6 +6698,11 @@ static int __iwl_up(struct iwl_priv *priv)
                return 0;
        }
 
+       if (!priv->ucode_data_backup.v_addr || !priv->ucode_data.v_addr) {
+               IWL_ERROR("ucode not available for device bringup\n");
+               return -EIO;
+       }
+
        iwl_write32(priv, CSR_INT, 0xFFFFFFFF);
 
        rc = iwl_hw_nic_init(priv);