From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Felix Fietkau <nbd@openwrt.org>,
"John W. Linville" <linville@tuxdriver.com>
Subject: [ 08/15] ath9k: fix double-free bug on beacon generate failure
Date: Fri, 1 Feb 2013 11:48:41 +0100 [thread overview]
Message-ID: <20130201104757.070340263@linuxfoundation.org> (raw)
In-Reply-To: <20130201104756.470588207@linuxfoundation.org>
3.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Fietkau <nbd@openwrt.org>
commit 1adb2e2b5f85023d17eb4f95386a57029df27c88 upstream.
When the next beacon is sent, the ath_buf from the previous run is reused.
If getting a new beacon from mac80211 fails, bf->bf_mpdu is not reset, yet
the skb is freed, leading to a double-free on the next beacon tx attempt,
resulting in a system crash.
Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/ath/ath9k/beacon.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/net/wireless/ath/ath9k/beacon.c
+++ b/drivers/net/wireless/ath/ath9k/beacon.c
@@ -159,6 +159,7 @@ static struct ath_buf *ath_beacon_genera
skb->len, DMA_TO_DEVICE);
dev_kfree_skb_any(skb);
bf->bf_buf_addr = 0;
+ bf->bf_mpdu = NULL;
}
/* Get a new beacon from mac80211 */
next prev parent reply other threads:[~2013-02-01 10:48 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20130201104756.470588207@linuxfoundation.org>
2013-02-01 10:48 ` [ 01/15] can: c_can: fix invalid error codes Greg Kroah-Hartman
2013-02-01 10:48 ` [ 02/15] can: ti_hecc: " Greg Kroah-Hartman
2013-02-01 10:48 ` [ 03/15] can: pch_can: " Greg Kroah-Hartman
2013-02-01 10:48 ` [ 04/15] fs/cifs/cifs_dfs_ref.c: fix potential memory leakage Greg Kroah-Hartman
2013-02-01 10:48 ` [ 05/15] ARM: DMA: Fix struct page iterator in dma_cache_maint() to work with sparsemem Greg Kroah-Hartman
2013-02-01 10:48 ` [ 06/15] Bluetooth: Fix sending HCI commands after reset Greg Kroah-Hartman
2013-02-01 10:48 ` [ 07/15] ath9k_htc: Fix memory leak Greg Kroah-Hartman
2013-02-01 10:48 ` Greg Kroah-Hartman [this message]
2013-02-01 10:48 ` [ 09/15] ALSA: usb-audio: fix invalid length check for RME and other UAC 2 devices Greg Kroah-Hartman
2013-02-01 10:48 ` [ 10/15] EDAC: Test correct variable in ->store function Greg Kroah-Hartman
2013-02-01 10:48 ` [ 11/15] Bluetooth: Fix incorrect strncpy() in hidp_setup_hid() Greg Kroah-Hartman
2013-02-01 10:48 ` [ 12/15] smp: Fix SMP function call empty cpu mask race Greg Kroah-Hartman
2013-02-01 10:48 ` [ 13/15] x86/msr: Add capabilities check Greg Kroah-Hartman
2013-02-01 10:48 ` [ 14/15] efi, x86: Pass a proper identity mapping in efi_call_phys_prelog Greg Kroah-Hartman
2013-02-01 10:48 ` [ 15/15] x86/Sandy Bridge: Sandy Bridge workaround depends on CONFIG_PCI Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20130201104757.070340263@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linville@tuxdriver.com \
--cc=nbd@openwrt.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.