* Double 'put' of bss in mac80211/mlme.c?
@ 2013-06-14 23:34 Ben Greear
2013-06-14 23:38 ` Ben Greear
0 siblings, 1 reply; 2+ messages in thread
From: Ben Greear @ 2013-06-14 23:34 UTC (permalink / raw)
To: linux-wireless@vger.kernel.org
Looks like an easy way to leak ies would be to mess up the
ref counting on bss objects.
While looking at such code, I found this in mac80211/mlme.c
The destroy_assoc_data does a put_bss, and then it is put again
directly. Is this on purpose, or would this effectively cause
a double-free?
if (!ieee80211_assoc_success(sdata, *bss, mgmt, len)) {
/* oops -- internal error -- send timeout for now */
ieee80211_destroy_assoc_data(sdata, false);
cfg80211_put_bss(sdata->local->hw.wiphy, *bss);
return RX_MGMT_CFG80211_ASSOC_TIMEOUT;
}
Thanks,
Ben
--
Ben Greear <greearb@candelatech.com>
Candela Technologies Inc http://www.candelatech.com
^ permalink raw reply [flat|nested] 2+ messages in thread* Re: Double 'put' of bss in mac80211/mlme.c?
2013-06-14 23:34 Double 'put' of bss in mac80211/mlme.c? Ben Greear
@ 2013-06-14 23:38 ` Ben Greear
0 siblings, 0 replies; 2+ messages in thread
From: Ben Greear @ 2013-06-14 23:38 UTC (permalink / raw)
To: linux-wireless@vger.kernel.org
On 06/14/2013 04:34 PM, Ben Greear wrote:
> Looks like an easy way to leak ies would be to mess up the
> ref counting on bss objects.
>
> While looking at such code, I found this in mac80211/mlme.c
>
> The destroy_assoc_data does a put_bss, and then it is put again
> directly. Is this on purpose, or would this effectively cause
> a double-free?
>
> if (!ieee80211_assoc_success(sdata, *bss, mgmt, len)) {
> /* oops -- internal error -- send timeout for now */
> ieee80211_destroy_assoc_data(sdata, false);
> cfg80211_put_bss(sdata->local->hw.wiphy, *bss);
> return RX_MGMT_CFG80211_ASSOC_TIMEOUT;
> }
>
> Thanks,
> Ben
>
Gah, nevermind...one is assoc_data->bss, the other is auth_data->bss.
Thanks,
Ben
--
Ben Greear <greearb@candelatech.com>
Candela Technologies Inc http://www.candelatech.com
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2013-06-14 23:38 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-06-14 23:34 Double 'put' of bss in mac80211/mlme.c? Ben Greear
2013-06-14 23:38 ` Ben Greear
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).