From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from esa5.microchip.iphmx.com ([216.71.150.166]:65532 "EHLO esa5.microchip.iphmx.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751835AbeDLF4p (ORCPT ); Thu, 12 Apr 2018 01:56:45 -0400 Date: Thu, 12 Apr 2018 11:26:38 +0530 From: Ajay Singh To: CC: Subject: Re: [PATCH 1/3] staging: wilc1000: fix NULL pointer exception in host_int_parse_assoc_resp_info() Message-ID: <20180412112638.7610ba20@ajaysk-VirtualBox> In-Reply-To: <1523439520-12965-1-git-send-email-ajay.kathat@microchip.com> References: <1523439520-12965-1-git-send-email-ajay.kathat@microchip.com> MIME-Version: 1.0 Content-Type: text/plain; charset="US-ASCII" Content-Transfer-Encoding: 7bit Sender: stable-owner@vger.kernel.org List-ID: Please ignore this patch. I will resubmit the patch again. On Wed, 11 Apr 2018 15:08:40 +0530 Ajay Singh wrote: > Commit fe014d4e6b55 (staging: wilc1000: free memory allocated for > general info message from firmware) introduced bug by using wrong > source address in kmemdup(). 'conn_info.req_ies' is used for source > address in kempdup() instead of 'hif_drv->usr_conn_req.ies'. > > This commit fixes the NULL pointer dereference issue in > host_int_parse_assoc_resp_info() by using the correct source > address in kmemdup(). > > Fixes: fe014d4e6b55 (staging: wilc1000: free memory allocated for > general info message from firmware) > Cc: stable@vger.kernel.org > Signed-off-by: Ajay Singh > Tested-by: Ajay Singh > --- > drivers/staging/wilc1000/host_interface.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/staging/wilc1000/host_interface.c > b/drivers/staging/wilc1000/host_interface.c index 316d73c..302e3cb > 100644 --- a/drivers/staging/wilc1000/host_interface.c > +++ b/drivers/staging/wilc1000/host_interface.c > @@ -1387,7 +1387,7 @@ static inline void > host_int_parse_assoc_resp_info(struct wilc_vif *vif, } > > if (hif_drv->usr_conn_req.ies) { > - conn_info.req_ies = kmemdup(conn_info.req_ies, > + conn_info.req_ies = > kmemdup(hif_drv->usr_conn_req.ies, hif_drv->usr_conn_req.ies_len, > GFP_KERNEL); > if (conn_info.req_ies) Regards, Ajay