atm: idt77252: fix null-ptr-dereference
[ Upstream commit 4416e98594dc04590ebc498fc4e530009535c511 ] this one is similar to the phy_data allocation fix in uPD98402, the driver allocate the idt77105_priv and store to dev_data but later dereference using dev->dev_data, which will cause null-ptr-dereference. fix this issue by changing dev_data to phy_data so that PRIV(dev) can work correctly. Signed-off-by: Tong Zhang <ztong0001@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
6b2844ad7b
commit
981ba9c9a5
|
@ -262,7 +262,7 @@ static int idt77105_start(struct atm_dev *dev)
|
||||||
{
|
{
|
||||||
unsigned long flags;
|
unsigned long flags;
|
||||||
|
|
||||||
if (!(dev->dev_data = kmalloc(sizeof(struct idt77105_priv),GFP_KERNEL)))
|
if (!(dev->phy_data = kmalloc(sizeof(struct idt77105_priv),GFP_KERNEL)))
|
||||||
return -ENOMEM;
|
return -ENOMEM;
|
||||||
PRIV(dev)->dev = dev;
|
PRIV(dev)->dev = dev;
|
||||||
spin_lock_irqsave(&idt77105_priv_lock, flags);
|
spin_lock_irqsave(&idt77105_priv_lock, flags);
|
||||||
|
@ -337,7 +337,7 @@ static int idt77105_stop(struct atm_dev *dev)
|
||||||
else
|
else
|
||||||
idt77105_all = walk->next;
|
idt77105_all = walk->next;
|
||||||
dev->phy = NULL;
|
dev->phy = NULL;
|
||||||
dev->dev_data = NULL;
|
dev->phy_data = NULL;
|
||||||
kfree(walk);
|
kfree(walk);
|
||||||
break;
|
break;
|
||||||
}
|
}
|
||||||
|
|
Loading…
Reference in New Issue