ssb: fix NULL ptr deref when pcihost_wrapper is used (da1fdb02) · Commits · 戴 / test

Ethernet driver b44 does register ssb by it's pcihost_wrapper and doesn't set ssb_chipcommon. A check on this value introduced with commit and triggers: BUG: unable to handle kernel NULL pointer dereference at 00000010 IP: [<c1266c36>] ssb_is_sprom_available+0x16/0x30 Signed-off-by:

Christoph Fritz <chf.fritz@googlemail.com> Signed-off-by:

John W. Linville <linville@tuxdriver.com>

drivers/ssb/pci.c

+6 −3

Original line number	Diff line number	Diff line
		@@ -625,9 +625,12 @@ static int ssb_pci_sprom_get(struct ssb_bus *bus,
		ssb_printk(KERN_ERR PFX "No SPROM available!\n");
		return -ENODEV;
		}

		if (bus->chipco.dev) { /* can be unavailible! */
		bus->sprom_offset = (bus->chipco.dev->id.revision < 31) ?
		SSB_SPROM_BASE1 : SSB_SPROM_BASE31;
		} else {
		bus->sprom_offset = SSB_SPROM_BASE1;
		}

		buf = kcalloc(SSB_SPROMSIZE_WORDS_R123, sizeof(u16), GFP_KERNEL);
		if (!buf)

drivers/ssb/sprom.c

+1 −0

Original line number	Diff line number	Diff line
		@@ -185,6 +185,7 @@ bool ssb_is_sprom_available(struct ssb_bus *bus)
		/* this routine differs from specs as we do not access SPROM directly
		on PCMCIA */
		if (bus->bustype == SSB_BUSTYPE_PCI &&
		bus->chipco.dev && /* can be unavailible! */
		bus->chipco.dev->id.revision >= 31)
		return bus->chipco.capabilities & SSB_CHIPCO_CAP_SPROM;

Admin message