b43: Fix possible NULL pointer dereference in DMA code

a cut-down version of commit 028118a5f09a9c807e6b43e2231efdff9f224c74 upstream

This fixes a possible NULL pointer dereference in an error path of the
DMA allocation error checking code. In case the DMA allocation address is invalid,
the dev pointer is dereferenced for unmapping of the buffer.

Reported-by: Miles Lane <miles.lane@gmail.com>
Signed-off-by: Michael Buesch <mb@bu3sch.de>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

diff --git a/drivers/net/wireless/b43/dma.c b/drivers/net/wireless/b43/dma.c
index 4ec191556f237f7cdaf480e7441a0dbf5505561a..f74dba292b38990cf7b1211a68fec9d3e5798e80 100644 (file)
--- a/drivers/net/wireless/b43/dma.c
+++ b/drivers/net/wireless/b43/dma.c
@@ -850,6 +850,7 @@ struct b43_dmaring *b43_setup_dmaring(struct b43_wldev *dev,
        if (!ring)
                goto out;
        ring->type = type;
+       ring->dev = dev;
 
        nr_slots = B43_RXRING_SLOTS;
        if (for_tx)
@@ -901,7 +902,6 @@ struct b43_dmaring *b43_setup_dmaring(struct b43_wldev *dev,
                                 DMA_TO_DEVICE);
        }
 
-       ring->dev = dev;
        ring->nr_slots = nr_slots;
        ring->mmio_base = b43_dmacontroller_base(type, controller_index);
        ring->index = controller_index;