From: Ben Greear <greearb@candelatech.com>
To: Eliad Peller <eliad@wizery.com>
Cc: Johannes Berg <johannes@sipsolutions.net>,
linux-wireless@vger.kernel.org
Subject: Re: [PATCH] cfg80211: fix memory leak/corruption of bss_list
Date: Thu, 17 May 2012 14:43:56 -0700 [thread overview]
Message-ID: <4FB5711C.1050207@candelatech.com> (raw)
In-Reply-To: <CAB3XZEcWGYAsPpuxs7Fs3a5c8ufkJOeEpJ3FgWyWttos6dYdKQ@mail.gmail.com>
On 05/17/2012 02:34 PM, Eliad Peller wrote:
> On Thu, May 17, 2012 at 10:47 PM, Johannes Berg
> <johannes@sipsolutions.net> wrote:
>> On Thu, 2012-05-17 at 19:06 +0300, Eliad Peller wrote:
>>> cfg80211_dev_free() calls cfg80211_put_bss() directly on all
>>> the remaining bss entries, skipping the proper bss entry
>>> cleanup that usually made by __cfg80211_unlink_bss(), and
>>> leaving the bss_list and the rb_tree with dangling pointers.
>>
>>> list_for_each_entry_safe(scan, tmp,&rdev->bss_list, list)
>>> - cfg80211_put_bss(&scan->pub);
>>> + cfg80211_unlink_bss(&rdev->wiphy,&scan->pub);
>>> kfree(rdev);
>>
>> I don't see why we care, we free rdev anyway.
>>
> yeah, you have a point here...
>
> we got a crash report for an older kernel with some custom patches,
> that indicated a possible write-after-free on the bss release. i was
> probably too rushed to blame this code.
Ahhh, as luck would have it..we saw a crash today (in a hacked 3.3.4) that could
be explained by a stale bss reference, so I was all excited by your patch,
thinking I didn't have to go looking for the bug :)
My crash was in an older version of the ethtool-stats logic,
so it could just be my bug, as well....
Thanks,
Ben
--
Ben Greear <greearb@candelatech.com>
Candela Technologies Inc http://www.candelatech.com
prev parent reply other threads:[~2012-05-17 21:44 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-05-17 16:06 [PATCH] cfg80211: fix memory leak/corruption of bss_list Eliad Peller
2012-05-17 19:29 ` Ben Greear
2012-05-17 21:39 ` Eliad Peller
2012-05-17 19:47 ` Johannes Berg
2012-05-17 21:34 ` Eliad Peller
2012-05-17 21:43 ` Ben Greear [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4FB5711C.1050207@candelatech.com \
--to=greearb@candelatech.com \
--cc=eliad@wizery.com \
--cc=johannes@sipsolutions.net \
--cc=linux-wireless@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).