[PATCH] mac80211: fix invalid kfree on sched scan

[PATCH] mac80211: fix invalid kfree on sched scan

[Eliad Peller]

Commit 30dd3ed ("mac80211: don't hang on to sched_scan_ies")
converted sched_scan_ies to a local variable.
However, since it wasn't initialized, in a case of
unsupported band, sched_scan_ies.ie[] was uninitialized,
and freeing it could corrupt the memory.

Fix it by simply initializing sched_scan_ies to 0.

Signed-off-by: Eliad Peller <eliad@wizery.com>
---
 net/mac80211/scan.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index 13d2329..8e9bb168 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -934,7 +934,7 @@ int ieee80211_request_sched_scan_start(struct ieee80211_sub_if_data *sdata,
 				       struct cfg80211_sched_scan_request *req)
 {
 	struct ieee80211_local *local = sdata->local;
-	struct ieee80211_sched_scan_ies sched_scan_ies;
+	struct ieee80211_sched_scan_ies sched_scan_ies = {};
 	int ret, i;
 
 	mutex_lock(&local->mtx);
-- 
1.7.6.401.g6a319

Re: [PATCH] mac80211: fix invalid kfree on sched scan

[Johannes Berg]

On Fri, 2012-11-16 at 10:46 +0200, Eliad Peller wrote:
> Commit 30dd3ed ("mac80211: don't hang on to sched_scan_ies")
> converted sched_scan_ies to a local variable.
> However, since it wasn't initialized, in a case of
> unsupported band, sched_scan_ies.ie[] was uninitialized,
> and freeing it could corrupt the memory.
> 
> Fix it by simply initializing sched_scan_ies to 0.

Yep, already have that in the tree :-)

commit bca1e29fb54c51856dda6772d488d41b10ed91da
Author: David Spinadel <david.spinadel@intel.com>
Date:   Mon Oct 29 14:49:41 2012 +0200

    mac80211: init sched_scan_ies


johannes

Re: [PATCH] mac80211: fix invalid kfree on sched scan

[Eliad Peller]

On Fri, Nov 16, 2012 at 10:49 AM, Johannes Berg
<johannes@sipsolutions.net> wrote:
> On Fri, 2012-11-16 at 10:46 +0200, Eliad Peller wrote:
>> Commit 30dd3ed ("mac80211: don't hang on to sched_scan_ies")
>> converted sched_scan_ies to a local variable.
>> However, since it wasn't initialized, in a case of
>> unsupported band, sched_scan_ies.ie[] was uninitialized,
>> and freeing it could corrupt the memory.
>>
>> Fix it by simply initializing sched_scan_ies to 0.
>
> Yep, already have that in the tree :-)
>
> commit bca1e29fb54c51856dda6772d488d41b10ed91da
> Author: David Spinadel <david.spinadel@intel.com>
> Date:   Mon Oct 29 14:49:41 2012 +0200
>
>     mac80211: init sched_scan_ies
>
>
oops... sorry :)

Eliad.