Re: [PATCH] cfg80211: fix memory leak/corruption of bss_list

[Ben Greear <greearb@candelatech.com>]

On 05/17/2012 02:34 PM, Eliad Peller wrote:
> On Thu, May 17, 2012 at 10:47 PM, Johannes Berg
> <johannes@sipsolutions.net>  wrote:
>> On Thu, 2012-05-17 at 19:06 +0300, Eliad Peller wrote:
>>> cfg80211_dev_free() calls cfg80211_put_bss() directly on all
>>> the remaining bss entries, skipping the proper bss entry
>>> cleanup that usually made by __cfg80211_unlink_bss(), and
>>> leaving the bss_list and the rb_tree with dangling pointers.
>>
>>>        list_for_each_entry_safe(scan, tmp,&rdev->bss_list, list)
>>> -             cfg80211_put_bss(&scan->pub);
>>> +             cfg80211_unlink_bss(&rdev->wiphy,&scan->pub);
>>>        kfree(rdev);
>>
>> I don't see why we care, we free rdev anyway.
>>
> yeah, you have a point here...
>
> we got a crash report for an older kernel with some custom patches,
> that indicated a possible write-after-free on the bss release. i was
> probably too rushed to blame this code.

Ahhh, as luck would have it..we saw a crash today (in a hacked 3.3.4) that could
be explained by a stale bss reference, so I was all excited by your patch,
thinking I didn't have to go looking for the bug :)

My crash was in an older version of the ethtool-stats logic,
so it could just be my bug, as well....

Thanks,
Ben


-- 
Ben Greear <greearb@candelatech.com>
Candela Technologies Inc  http://www.candelatech.com