linux-kernel - [PATCH] staging: wicl1000: fix dereference after free in wilc_wlan

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <1442917490-26574-1-git-send-email-javier@osg.samsung.com>
Date:	Tue, 22 Sep 2015 12:24:50 +0200
From:	Javier Martinez Canillas <javier@....samsung.com>
To:	linux-kernel@...r.kernel.org
Cc:	Javier Martinez Canillas <javier@....samsung.com>,
	devel@...verdev.osuosl.org, linux-wireless@...r.kernel.org,
	Johnny Kim <johnny.kim@...el.com>,
	Tony Cho <tony.cho@...el.com>, Leo Kim <leo.kim@...el.com>,
	Glen Lee <glen.lee@...el.com>,
	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	Rachel Kim <rachel.kim@...el.com>,
	Chris Park <chris.park@...el.com>
Subject: [PATCH] staging: wicl1000: fix dereference after free in wilc_wlan_cleanup()

The wilc_wlan_cleanup() function iterates over the list of transmission
buffers freeing all of them and then iterates over the receive buffers
list to free all of them as well.

But on the receive loop a pointer to struct txq_entry_t is dereferenced
instead of the pointer to a struct rxq_entry_t. This not only causes a
dereference to a pointer already freed but also leaks the memory in the
struct rxq_entry_t buffer.

Fixes: c5c77ba18ea6 ("staging: wilc1000: Add SDIO/SPI 802.11 driver")
Signed-off-by: Javier Martinez Canillas <javier@....samsung.com>

---

 drivers/staging/wilc1000/wilc_wlan.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/wilc1000/wilc_wlan.c b/drivers/staging/wilc1000/wilc_wlan.c
index 4c25179c2fec..c40f143b00b7 100644
--- a/drivers/staging/wilc1000/wilc_wlan.c
+++ b/drivers/staging/wilc1000/wilc_wlan.c
@@ -1746,7 +1746,7 @@ static void wilc_wlan_cleanup(void)
 		if (rqe == NULL)
 			break;
 #ifdef MEMORY_DYNAMIC
-		kfree(tqe->buffer);
+		kfree(rqe->buffer);
 #endif
 		kfree(rqe);
 	} while (1);
-- 
2.4.3

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/