Fix crash due to passing invalid r2x00dev->eeprom_file pointer to
release_firmware(). Since we copy eeprom data with EEPROM_SIZE
in rt2800_read_eeprom() we can use eeprom_file->size as marker
if the file was crated by request_firmware().
Acked-by: Kristian Evensen <kristian.evensen@gmail.com>
Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
--- /dev/null
+++ b/drivers/net/wireless/ralink/rt2x00/rt2x00eeprom.c
--- /dev/null
+++ b/drivers/net/wireless/ralink/rt2x00/rt2x00eeprom.c
+/*
+ Copyright (C) 2004 - 2009 Ivo van Doorn <IvDoorn@gmail.com>
+ Copyright (C) 2004 - 2009 Gertjan van Wingerde <gwingerde@gmail.com>
+/*
+ Copyright (C) 2004 - 2009 Ivo van Doorn <IvDoorn@gmail.com>
+ Copyright (C) 2004 - 2009 Gertjan van Wingerde <gwingerde@gmail.com>
+
+void rt2x00lib_free_eeprom_file(struct rt2x00_dev *rt2x00dev)
+{
+
+void rt2x00lib_free_eeprom_file(struct rt2x00_dev *rt2x00dev)
+{
-+ release_firmware(rt2x00dev->eeprom_file);
++ if (rt2x00dev->eeprom_file && rt2x00dev->eeprom_file->size)
++ release_firmware(rt2x00dev->eeprom_file);
+ rt2x00dev->eeprom_file = NULL;
+}
--- a/drivers/net/wireless/ralink/rt2x00/rt2x00lib.h
+ rt2x00dev->eeprom_file = NULL;
+}
--- a/drivers/net/wireless/ralink/rt2x00/rt2x00lib.h
Supported chips: RT2880, RT3050, RT3052, RT3350, RT3352.
--- a/drivers/net/wireless/ralink/rt2x00/rt2x00eeprom.c
+++ b/drivers/net/wireless/ralink/rt2x00/rt2x00eeprom.c
Supported chips: RT2880, RT3050, RT3052, RT3350, RT3352.
--- a/drivers/net/wireless/ralink/rt2x00/rt2x00eeprom.c
+++ b/drivers/net/wireless/ralink/rt2x00/rt2x00eeprom.c
#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/kernel.h>
#include <linux/module.h>
+ rt2x00dev->eeprom[i] = swab16(rt2x00dev->eeprom[i]);
+
+ rt2x00dev->eeprom_file = &mtd_fw;
+ rt2x00dev->eeprom[i] = swab16(rt2x00dev->eeprom[i]);
+
+ rt2x00dev->eeprom_file = &mtd_fw;
+ mtd_fw.data = (const u8 *) rt2x00dev->eeprom;
+
+ dev_info(rt2x00dev->dev, "loaded eeprom from mtd device \"%s\"\n", part);
+ mtd_fw.data = (const u8 *) rt2x00dev->eeprom;
+
+ dev_info(rt2x00dev->dev, "loaded eeprom from mtd device \"%s\"\n", part);
static const char *
rt2x00lib_get_eeprom_file_name(struct rt2x00_dev *rt2x00dev)
{
static const char *
rt2x00lib_get_eeprom_file_name(struct rt2x00_dev *rt2x00dev)
{
-@@ -58,6 +120,9 @@ static int rt2x00lib_request_eeprom_file
+@@ -58,6 +119,9 @@ static int rt2x00lib_request_eeprom_file
const char *ee_name;
int retval;
const char *ee_name;
int retval;