From 9f5e60dd5ffca938da4cabc197af8b9405b5512e Mon Sep 17 00:00:00 2001 From: Jussi Kivilinna Date: Sun, 23 Mar 2008 12:45:44 +0200 Subject: [PATCH] rndis_host: fix oops when query for OID_GEN_PHYSICAL_MEDIUM fails When query for OID_GEN_PHYSICAL_MEDIUM fails, uninitialized pointer 'phym' is being accessed in generic_rndis_bind(), resulting OOPS. Patch fixes phym to be initialized and setup correctly when rndis_query() for physical medium fails. Bug was introduced by following commit: commit 039ee17d1baabaa21783a0d5ab3e8c6d8c794bdf Author: Jussi Kivilinna Date: Sun Jan 27 23:34:33 2008 +0200 Reported-by: Dmitri Monakhov Signed-off-by: Jussi Kivilinna Acked-by: David Brownell Signed-off-by: Jeff Garzik --- drivers/net/usb/rndis_host.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/drivers/net/usb/rndis_host.c b/drivers/net/usb/rndis_host.c index 727547a289..369c731114 100644 --- a/drivers/net/usb/rndis_host.c +++ b/drivers/net/usb/rndis_host.c @@ -283,7 +283,7 @@ generic_rndis_bind(struct usbnet *dev, struct usb_interface *intf, int flags) struct rndis_set_c *set_c; struct rndis_halt *halt; } u; - u32 tmp, *phym; + u32 tmp, phym_unspec, *phym; int reply_len; unsigned char *bp; @@ -363,12 +363,15 @@ generic_rndis_bind(struct usbnet *dev, struct usb_interface *intf, int flags) goto halt_fail_and_release; /* Check physical medium */ + phym = NULL; reply_len = sizeof *phym; retval = rndis_query(dev, intf, u.buf, OID_GEN_PHYSICAL_MEDIUM, 0, (void **) &phym, &reply_len); - if (retval != 0) + if (retval != 0 || !phym) { /* OID is optional so don't fail here. */ - *phym = RNDIS_PHYSICAL_MEDIUM_UNSPECIFIED; + phym_unspec = RNDIS_PHYSICAL_MEDIUM_UNSPECIFIED; + phym = &phym_unspec; + } if ((flags & FLAG_RNDIS_PHYM_WIRELESS) && *phym != RNDIS_PHYSICAL_MEDIUM_WIRELESS_LAN) { if (netif_msg_probe(dev)) -- 2.39.5