On 16 feb. 2012, at 20:44, Gabor Juhos <juhosg@xxxxxxxxxxx> wrote: > The 'rt2x00lib_probe_dev' function tries to > allocate the workqueue. If the allocation > fails, 'rt2x00_lib_remove_dev' is called on > the error path. Because 'rt2x00dev->workqueue' > is NULL in this case, the 'destroy_workqueue' > call will cause a NULL pointer dereference. > > Signed-off-by: Gabor Juhos <juhosg@xxxxxxxxxxx> Good catch. Acked-by: Gertjan van Wingerde <gwingerde@xxxxxxxxx> > --- > drivers/net/wireless/rt2x00/rt2x00dev.c | 3 ++- > 1 files changed, 2 insertions(+), 1 deletions(-) > > diff --git a/drivers/net/wireless/rt2x00/rt2x00dev.c b/drivers/net/wireless/rt2x00/rt2x00dev.c > index bae5b01..d62e64f 100644 > --- a/drivers/net/wireless/rt2x00/rt2x00dev.c > +++ b/drivers/net/wireless/rt2x00/rt2x00dev.c > @@ -1232,7 +1232,8 @@ void rt2x00lib_remove_dev(struct rt2x00_dev *rt2x00dev) > cancel_work_sync(&rt2x00dev->rxdone_work); > cancel_work_sync(&rt2x00dev->txdone_work); > } > - destroy_workqueue(rt2x00dev->workqueue); > + if (rt2x00dev->workqueue) > + destroy_workqueue(rt2x00dev->workqueue); > > /* > * Free the tx status fifo. > -- > 1.7.2.1 > > > _______________________________________________ > users mailing list > users@xxxxxxxxxxxxxxxxxxxxxxx > http://rt2x00.serialmonkey.com/mailman/listinfo/users_rt2x00.serialmonkey.com -- To unsubscribe from this list: send the line "unsubscribe linux-wireless" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
