The driver comments show an initialization sequence of: * i2400m_setup() * i2400m->bus_setup() * i2400m_bootrom_init() * register_netdev() * wimax_dev_add() * i2400m_dev_start() * __i2400m_dev_start() * i2400m_dev_bootstrap() dev_bootstrap() is where the firmware is loaded. So, if something calls get_drvinfo() from a register_netdevice_notifier (such as the cnic driver), we won't have a firmware name, and strncpy will crash. https://bugzilla.redhat.com/show_bug.cgi?id=808603 Signed-off-by: Bill Nottingham <notting at redhat.com> --- drivers/net/wimax/i2400m/netdev.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/net/wimax/i2400m/netdev.c b/drivers/net/wimax/i2400m/netdev.c index 63e4b70..e44f4e2 100644 --- a/drivers/net/wimax/i2400m/netdev.c +++ b/drivers/net/wimax/i2400m/netdev.c @@ -597,7 +597,8 @@ static void i2400m_get_drvinfo(struct net_device *net_dev, struct i2400m *i2400m = net_dev_to_i2400m(net_dev); strncpy(info->driver, KBUILD_MODNAME, sizeof(info->driver) - 1); - strncpy(info->fw_version, i2400m->fw_name, sizeof(info->fw_version) - 1); + if (i2400m->fw_name) + strncpy(info->fw_version, i2400m->fw_name, sizeof(info->fw_version) - 1); if (net_dev->dev.parent) strncpy(info->bus_info, dev_name(net_dev->dev.parent), sizeof(info->bus_info) - 1); -- 1.7.9.3
