Re: [PATCH v2] p54usb: fix nasty use after free

[Artur Skawina <art.08.09@gmail.com>]

Apparently an earlier version of this patch went into w-t, the
committed version is still missing the skb_pull removal shown below.
It's an error path so it doesn't usually get executed.

Also, Christian's patch http://www.spinics.net/lists/linux-wireless/msg27282.html
which makes net2280 devices work still hasn't made it. (it fixes an
unrelated c&p bug it seems, but that change is obviously correct).

artur

Christian Lamparter wrote:
> In theory, the firmware acks the received a data frame, before signaling the driver to free it again.
> However Artur Skawina has shown that it can happen in reverse order as well.
> This is very bad and could lead to memory corruptions, oopses and panics.
>  
> Thanks to Artur Skawina <art.08.09@gmail.com> for reporting and debugging this issue.
> 
> Tested-by: Artur Skawina <art.08.09@gmail.com>
> Signed-off-by: Christian Lamparter <chunkeey@web.de>
> ---
> Changes:
> 	- removed a forgotten skb_pull from p54u_tx_net2280 error - path.

> @@ -360,14 +352,12 @@ static void p54u_tx_net2280(struct ieee80211_hw *dev, struct sk_buff *skb)
>  		usb_unanchor_urb(data_urb);
>  		goto out;
>  	}
> - out:
> +out:
>  	usb_free_urb(int_urb);
>  	usb_free_urb(data_urb);
>  
> -	if (err) {
> -		skb_pull(skb, sizeof(*hdr));
> +	if (err)
>  		p54_free_skb(dev, skb);
> -	}
>  }