aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorStanislaw Gruszka <sgruszka@redhat.com>2019-02-24 10:23:18 +0100
committerDaniel Golle <daniel@makrotopia.org>2019-02-26 22:57:32 +0100
commit426ffc563a94ca12531ff8a2df598185ba88487e (patch)
treecaf833d18b70f6c4b43f4572b4aea210c6872a21
parent0f89c17b578faea7374373eaf63ff91fafc1c4c6 (diff)
downloadupstream-426ffc563a94ca12531ff8a2df598185ba88487e.tar.gz
upstream-426ffc563a94ca12531ff8a2df598185ba88487e.tar.bz2
upstream-426ffc563a94ca12531ff8a2df598185ba88487e.zip
mac80211: rt2x00: fix crash on release_firmware
Fix crash due to passing invalid r2x00dev->eeprom_file pointer to release_firmware(). Since we copy eeprom data with EEPROM_SIZE in rt2800_read_eeprom() we can use eeprom_file->size as marker if the file was crated by request_firmware(). Acked-by: Kristian Evensen <kristian.evensen@gmail.com> Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
-rw-r--r--package/kernel/mac80211/patches/rt2x00/602-rt2x00-introduce-rt2x00eeprom.patch5
-rw-r--r--package/kernel/mac80211/patches/rt2x00/604-rt2x00-load-eeprom-on-SoC-from-a-mtd-device-defines-.patch5
2 files changed, 5 insertions, 5 deletions
diff --git a/package/kernel/mac80211/patches/rt2x00/602-rt2x00-introduce-rt2x00eeprom.patch b/package/kernel/mac80211/patches/rt2x00/602-rt2x00-introduce-rt2x00eeprom.patch
index ab31d8485d..c6d4862e41 100644
--- a/package/kernel/mac80211/patches/rt2x00/602-rt2x00-introduce-rt2x00eeprom.patch
+++ b/package/kernel/mac80211/patches/rt2x00/602-rt2x00-introduce-rt2x00eeprom.patch
@@ -152,7 +152,7 @@
--- /dev/null
+++ b/drivers/net/wireless/ralink/rt2x00/rt2x00eeprom.c
-@@ -0,0 +1,105 @@
+@@ -0,0 +1,106 @@
+/*
+ Copyright (C) 2004 - 2009 Ivo van Doorn <IvDoorn@gmail.com>
+ Copyright (C) 2004 - 2009 Gertjan van Wingerde <gwingerde@gmail.com>
@@ -255,7 +255,8 @@
+
+void rt2x00lib_free_eeprom_file(struct rt2x00_dev *rt2x00dev)
+{
-+ release_firmware(rt2x00dev->eeprom_file);
++ if (rt2x00dev->eeprom_file && rt2x00dev->eeprom_file->size)
++ release_firmware(rt2x00dev->eeprom_file);
+ rt2x00dev->eeprom_file = NULL;
+}
--- a/drivers/net/wireless/ralink/rt2x00/rt2x00lib.h
diff --git a/package/kernel/mac80211/patches/rt2x00/604-rt2x00-load-eeprom-on-SoC-from-a-mtd-device-defines-.patch b/package/kernel/mac80211/patches/rt2x00/604-rt2x00-load-eeprom-on-SoC-from-a-mtd-device-defines-.patch
index a98b49c541..b3e1220b60 100644
--- a/package/kernel/mac80211/patches/rt2x00/604-rt2x00-load-eeprom-on-SoC-from-a-mtd-device-defines-.patch
+++ b/package/kernel/mac80211/patches/rt2x00/604-rt2x00-load-eeprom-on-SoC-from-a-mtd-device-defines-.patch
@@ -22,7 +22,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
Supported chips: RT2880, RT3050, RT3052, RT3350, RT3352.
--- a/drivers/net/wireless/ralink/rt2x00/rt2x00eeprom.c
+++ b/drivers/net/wireless/ralink/rt2x00/rt2x00eeprom.c
-@@ -26,11 +26,73 @@
+@@ -26,11 +26,72 @@
#include <linux/kernel.h>
#include <linux/module.h>
@@ -84,7 +84,6 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
+ rt2x00dev->eeprom[i] = swab16(rt2x00dev->eeprom[i]);
+
+ rt2x00dev->eeprom_file = &mtd_fw;
-+ mtd_fw.size = len;
+ mtd_fw.data = (const u8 *) rt2x00dev->eeprom;
+
+ dev_info(rt2x00dev->dev, "loaded eeprom from mtd device \"%s\"\n", part);
@@ -96,7 +95,7 @@ Signed-off-by: John Crispin <blogic@openwrt.org>
static const char *
rt2x00lib_get_eeprom_file_name(struct rt2x00_dev *rt2x00dev)
{
-@@ -58,6 +120,9 @@ static int rt2x00lib_request_eeprom_file
+@@ -58,6 +119,9 @@ static int rt2x00lib_request_eeprom_file
const char *ee_name;
int retval;