| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20130107024827.GZ27530@wantstofly.org> Date: Mon, 7 Jan 2013 03:48:27 +0100 From: Lennert Buytenhek <buytenh@...tstofly.org> To: Nickolai Zeldovich <nickolai@...il.mit.edu> Cc: "John W. Linville" <linville@...driver.com>, linux-wireless@...r.kernel.org, linux-kernel@...r.kernel.org Subject: Re: [PATCH] drivers/net/wireless/mwl8k.c: avoid use-after-free On Sun, Jan 06, 2013 at 08:27:22PM -0500, Nickolai Zeldovich wrote: > Do not dereference p->station_id after kfree(cmd) because p > points into the cmd data structure. Good catch, but the patch would be better titled "mwl8k.c: avoid having a working driver", as the station_id return code _is_ needed by the caller in case of success. > Signed-off-by: Nickolai Zeldovich <nickolai@...il.mit.edu> > --- > drivers/net/wireless/mwl8k.c | 4 +++- > 1 file changed, 3 insertions(+), 1 deletion(-) > > diff --git a/drivers/net/wireless/mwl8k.c b/drivers/net/wireless/mwl8k.c > index f221b95..83564d3 100644 > --- a/drivers/net/wireless/mwl8k.c > +++ b/drivers/net/wireless/mwl8k.c > @@ -4250,9 +4250,11 @@ static int mwl8k_cmd_update_stadb_add(struct ieee80211_hw *hw, > p->amsdu_enabled = 0; > > rc = mwl8k_post_cmd(hw, &cmd->header); > + if (!rc) > + rc = p->station_id; > kfree(cmd); > > - return rc ? rc : p->station_id; > + return rc; > } > > static int mwl8k_cmd_update_stadb_del(struct ieee80211_hw *hw, > -- > 1.7.10.4 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists