* [PATCH] wl12xx: fix use after free
@ 2011-01-30 10:29 Mathias Krause
2011-01-31 19:47 ` John W. Linville
0 siblings, 1 reply; 3+ messages in thread
From: Mathias Krause @ 2011-01-30 10:29 UTC (permalink / raw)
To: linux-wireless; +Cc: Kalle Valo, John W. Linville, Mathias Krause
When DEBUG_SPI is included in the debug log level wl1271_spi_reset()
will dump the already freed memory instead of the SPI buffer.
This bug was spotted by the semantic patch tool coccinelle using the
script found at scripts/coccinelle/free/kfree.cocci.
More information about semantic patching is available at
http://coccinelle.lip6.fr/
Signed-off-by: Mathias Krause <minipli@googlemail.com>
---
drivers/net/wireless/wl12xx/spi.c | 3 +--
1 files changed, 1 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/wl12xx/spi.c b/drivers/net/wireless/wl12xx/spi.c
index 4671491..7145ea5 100644
--- a/drivers/net/wireless/wl12xx/spi.c
+++ b/drivers/net/wireless/wl12xx/spi.c
@@ -110,9 +110,8 @@ static void wl1271_spi_reset(struct wl1271 *wl)
spi_message_add_tail(&t, &m);
spi_sync(wl_to_spi(wl), &m);
- kfree(cmd);
-
wl1271_dump(DEBUG_SPI, "spi reset -> ", cmd, WSPI_INIT_CMD_LEN);
+ kfree(cmd);
}
static void wl1271_spi_init(struct wl1271 *wl)
--
1.5.6.5
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] wl12xx: fix use after free
2011-01-30 10:29 [PATCH] wl12xx: fix use after free Mathias Krause
@ 2011-01-31 19:47 ` John W. Linville
2011-01-31 20:14 ` Luciano Coelho
0 siblings, 1 reply; 3+ messages in thread
From: John W. Linville @ 2011-01-31 19:47 UTC (permalink / raw)
To: Mathias Krause; +Cc: linux-wireless, Kalle Valo
On Sun, Jan 30, 2011 at 11:29:47AM +0100, Mathias Krause wrote:
> When DEBUG_SPI is included in the debug log level wl1271_spi_reset()
> will dump the already freed memory instead of the SPI buffer.
>
> This bug was spotted by the semantic patch tool coccinelle using the
> script found at scripts/coccinelle/free/kfree.cocci.
>
> More information about semantic patching is available at
> http://coccinelle.lip6.fr/
>
> Signed-off-by: Mathias Krause <minipli@googlemail.com>
Luca, I'll go ahead and apply this one directly to wireless-2.6.
John
--
John W. Linville Someday the world will need a hero, and you
linville@tuxdriver.com might be all we have. Be ready.
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] wl12xx: fix use after free
2011-01-31 19:47 ` John W. Linville
@ 2011-01-31 20:14 ` Luciano Coelho
0 siblings, 0 replies; 3+ messages in thread
From: Luciano Coelho @ 2011-01-31 20:14 UTC (permalink / raw)
To: John W. Linville
Cc: Mathias Krause, linux-wireless@vger.kernel.org, Kalle Valo
On Mon, 2011-01-31 at 20:47 +0100, John W. Linville wrote:
> On Sun, Jan 30, 2011 at 11:29:47AM +0100, Mathias Krause wrote:
> > When DEBUG_SPI is included in the debug log level wl1271_spi_reset()
> > will dump the already freed memory instead of the SPI buffer.
> >
> > This bug was spotted by the semantic patch tool coccinelle using the
> > script found at scripts/coccinelle/free/kfree.cocci.
> >
> > More information about semantic patching is available at
> > http://coccinelle.lip6.fr/
> >
> > Signed-off-by: Mathias Krause <minipli@googlemail.com>
>
> Luca, I'll go ahead and apply this one directly to wireless-2.6.
Okay, thanks John!
--
Cheers,
Luca.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2011-01-31 20:14 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2011-01-30 10:29 [PATCH] wl12xx: fix use after free Mathias Krause
2011-01-31 19:47 ` John W. Linville
2011-01-31 20:14 ` Luciano Coelho
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox