From: Lennert Buytenhek <buytenh@wantstofly.org>
To: Nickolai Zeldovich <nickolai@csail.mit.edu>
Cc: "John W. Linville" <linville@tuxdriver.com>,
linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH] drivers/net/wireless/mwl8k.c: avoid use-after-free
Date: Mon, 7 Jan 2013 03:48:27 +0100 [thread overview]
Message-ID: <20130107024827.GZ27530@wantstofly.org> (raw)
In-Reply-To: <1357522042-39255-1-git-send-email-nickolai@csail.mit.edu>
On Sun, Jan 06, 2013 at 08:27:22PM -0500, Nickolai Zeldovich wrote:
> Do not dereference p->station_id after kfree(cmd) because p
> points into the cmd data structure.
Good catch, but the patch would be better titled "mwl8k.c: avoid
having a working driver", as the station_id return code _is_ needed
by the caller in case of success.
> Signed-off-by: Nickolai Zeldovich <nickolai@csail.mit.edu>
> ---
> drivers/net/wireless/mwl8k.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/net/wireless/mwl8k.c b/drivers/net/wireless/mwl8k.c
> index f221b95..83564d3 100644
> --- a/drivers/net/wireless/mwl8k.c
> +++ b/drivers/net/wireless/mwl8k.c
> @@ -4250,9 +4250,11 @@ static int mwl8k_cmd_update_stadb_add(struct ieee80211_hw *hw,
> p->amsdu_enabled = 0;
>
> rc = mwl8k_post_cmd(hw, &cmd->header);
> + if (!rc)
> + rc = p->station_id;
> kfree(cmd);
>
> - return rc ? rc : p->station_id;
> + return rc;
> }
>
> static int mwl8k_cmd_update_stadb_del(struct ieee80211_hw *hw,
> --
> 1.7.10.4
next prev parent reply other threads:[~2013-01-07 2:57 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-01-07 1:27 [PATCH] drivers/net/wireless/mwl8k.c: avoid use-after-free Nickolai Zeldovich
2013-01-07 2:48 ` Lennert Buytenhek [this message]
2013-01-07 3:02 ` Nickolai Zeldovich
2013-01-07 3:19 ` Lennert Buytenhek
2013-01-07 3:03 ` Julian Calaby
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20130107024827.GZ27530@wantstofly.org \
--to=buytenh@wantstofly.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-wireless@vger.kernel.org \
--cc=linville@tuxdriver.com \
--cc=nickolai@csail.mit.edu \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.