commit b03a9db95a285e13a5e4f2913e9d22a84bf50cc6
author Senthil Balasubramanian <senthilkumar@atheros.com> Fri Mar 06 11:24:09 2009 +0530
committer John W. Linville <linville@tuxdriver.com> Mon Mar 16 18:09:30 2009 -0400
tree 7edbff7db9255054bf9568c1dda72dbe40270694
parent f0e6ce13c17afd74a49e0ef043d72581562f73ae

ath9k: RX buffers may be accessed/freed even before initialized/alloced.

accessing RXBUF list in ath_rx_cleanup may cause panic if
ath_descdma_setup fails even before RXBUF list is initialized.

Signed-off-by: Senthil Balasubramanian <senthilkumar@atheros.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

drivers/net/wireless/ath9k/main.c

diff --git a/drivers/net/wireless/ath9k/main.c b/drivers/net/wireless/ath9k/main.c
index 4bc43db..7d9c060 100644
--- a/drivers/net/wireless/ath9k/main.c
+++ b/drivers/net/wireless/ath9k/main.c
@@ -1773,6 +1773,7 @@
 	DPRINTF(sc, ATH_DBG_CONFIG, "%s DMA: %u buffers %u desc/buf\n",
 		name, nbuf, ndesc);
 
+	INIT_LIST_HEAD(head);
 	/* ath_desc must be a multiple of DWORDs */
 	if ((sizeof(struct ath_desc) % 4) != 0) {
 		DPRINTF(sc, ATH_DBG_FATAL, "ath_desc not DWORD aligned\n");
@@ -1823,7 +1824,6 @@
 	}
 	dd->dd_bufptr = bf;
 
-	INIT_LIST_HEAD(head);
 	for (i = 0; i < nbuf; i++, bf++, ds += ndesc) {
 		bf->bf_desc = ds;
 		bf->bf_daddr = DS2PHYS(dd, ds);