netdev - [PATCH resend] bcm43xx-d80211: Fix DMA TX skb doublefree

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <200701231740.18708.mb@bu3sch.de>
Date:	Tue, 23 Jan 2007 17:40:18 +0100
From:	Michael Buesch <mb@...sch.de>
To:	John Linville <linville@...driver.com>
Cc:	netdev@...r.kernel.org, bcm43xx-dev@...ts.berlios.de
Subject: [PATCH resend] bcm43xx-d80211: Fix DMA TX skb doublefree

This fixes a possible double-free of the TX skb buffers.
Always NULL the pointer after freeing.

Signed-off-by: Michael Buesch <mb@...sch.de>

--

I already sent this patch to you on 21 Dec 2006.
This is a pretty critical patch, so I'd like to make sure
it's in your merge queue and is not lost.


Index: wireless-dev/drivers/net/wireless/d80211/bcm43xx/bcm43xx_dma.c
===================================================================
--- wireless-dev.orig/drivers/net/wireless/d80211/bcm43xx/bcm43xx_dma.c	2006-12-07 17:25:19.000000000 +0100
+++ wireless-dev/drivers/net/wireless/d80211/bcm43xx/bcm43xx_dma.c	2006-12-21 19:05:28.000000000 +0100
@@ -388,6 +388,7 @@ void free_descriptor_buffer(struct bcm43
 			dev_kfree_skb_irq(meta->skb);
 		else
 			dev_kfree_skb(meta->skb);
+		meta->skb = NULL;
 	}
 }
 
@@ -1131,6 +1132,7 @@ void bcm43xx_dma_handle_txstatus(struct 
 			meta->txstat.retry_count = status->frame_count - 1;
 			ieee80211_tx_status_irqsafe(bcm->ieee, meta->skb, &(meta->txstat));
 			/* skb is freed by ieee80211_tx_status_irqsafe() */
+			meta->skb = NULL;
 		} else {
 			/* No need to call free_descriptor_buffer here, as
 			 * this is only the txhdr, which is not allocated.


-- 
Greetings Michael.

-
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html