netdev - [PATCH] bcm43xx_d80211: Fix major memory corruption bug

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Sun, 21 Jan 2007 00:27:40 -0500
From:	Pavel Roskin <proski@....org>
To:	netdev@...r.kernel.org
Cc:	Michael Buesch <mb@...sch.de>
Subject: [PATCH] bcm43xx_d80211: Fix major memory corruption bug

Set phy->lo_control to NULL whenever it's freed.  Failure to do so leads
to zeroing a block of memory that uses to hold *phy->lo_control, which
caused random crashes down the road.

Signed-off-by: Pavel Roskin <proski@....org>
---

 drivers/net/wireless/d80211/bcm43xx/bcm43xx_main.c |    2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)

diff --git a/drivers/net/wireless/d80211/bcm43xx/bcm43xx_main.c b/drivers/net/wireless/d80211/bcm43xx/bcm43xx_main.c
index 3064322..62d4dc9 100644
--- a/drivers/net/wireless/d80211/bcm43xx/bcm43xx_main.c
+++ b/drivers/net/wireless/d80211/bcm43xx/bcm43xx_main.c
@@ -3048,6 +3048,7 @@ static void bcm43xx_wireless_core_exit(struct bcm43xx_wldev *dev)
 	if (phy->dyn_tssi_tbl)
 		kfree(phy->tssi2dbm);
 	kfree(phy->lo_control);
+	phy->lo_control = NULL;
 	ssb_chipco_set_clockmode(chipco, SSB_CLKMODE_SLOW);
 	bcm43xx_vstack_free(&dev->genstack);
 	bcm43xx_set_status(dev, BCM43xx_STAT_UNINIT);
@@ -3179,6 +3180,7 @@ err_kfree_tssitbl:
 		kfree(phy->tssi2dbm);
 err_kfree_lo_control:
 	kfree(phy->lo_control);
+	phy->lo_control = NULL;
 err_slowclock:
 	ssb_chipco_set_clockmode(chipco, SSB_CLKMODE_SLOW);
 	bcm43xx_set_status(dev, BCM43xx_STAT_UNINIT);

-
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html