[PATCH] staging: wicl1000: fix dereference after free in wilc_wlan_cleanup()

[PATCH] staging: wicl1000: fix dereference after free in wilc_wlan_cleanup()

[Javier Martinez Canillas]

The wilc_wlan_cleanup() function iterates over the list of transmission
buffers freeing all of them and then iterates over the receive buffers
list to free all of them as well.

But on the receive loop a pointer to struct txq_entry_t is dereferenced
instead of the pointer to a struct rxq_entry_t. This not only causes a
dereference to a pointer already freed but also leaks the memory in the
struct rxq_entry_t buffer.

Fixes: c5c77ba18ea6 ("staging: wilc1000: Add SDIO/SPI 802.11 driver")
Signed-off-by: Javier Martinez Canillas <javier@osg.samsung.com>

---

 drivers/staging/wilc1000/wilc_wlan.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/wilc1000/wilc_wlan.c b/drivers/staging/wilc1000/wilc_wlan.c
index 4c25179c2fec..c40f143b00b7 100644
--- a/drivers/staging/wilc1000/wilc_wlan.c
+++ b/drivers/staging/wilc1000/wilc_wlan.c
@@ -1746,7 +1746,7 @@ static void wilc_wlan_cleanup(void)
 		if (rqe == NULL)
 			break;
 #ifdef MEMORY_DYNAMIC
-		kfree(tqe->buffer);
+		kfree(rqe->buffer);
 #endif
 		kfree(rqe);
 	} while (1);
-- 
2.4.3

Re: [PATCH] staging: wicl1000: fix dereference after free in wilc_wlan_cleanup()

[Sudip Mukherjee]

On Tue, Sep 22, 2015 at 12:24:50PM +0200, Javier Martinez Canillas wrote:
> The wilc_wlan_cleanup() function iterates over the list of transmission
> buffers freeing all of them and then iterates over the receive buffers
> list to free all of them as well.
> 
> But on the receive loop a pointer to struct txq_entry_t is dereferenced
> instead of the pointer to a struct rxq_entry_t. This not only causes a
> dereference to a pointer already freed but also leaks the memory in the
> struct rxq_entry_t buffer.
> 
> Fixes: c5c77ba18ea6 ("staging: wilc1000: Add SDIO/SPI 802.11 driver")
> Signed-off-by: Javier Martinez Canillas <javier@osg.samsung.com>
> 
> ---
> 
>  drivers/staging/wilc1000/wilc_wlan.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/staging/wilc1000/wilc_wlan.c b/drivers/staging/wilc1000/wilc_wlan.c
> index 4c25179c2fec..c40f143b00b7 100644
> --- a/drivers/staging/wilc1000/wilc_wlan.c
> +++ b/drivers/staging/wilc1000/wilc_wlan.c
> @@ -1746,7 +1746,7 @@ static void wilc_wlan_cleanup(void)
>  		if (rqe == NULL)
>  			break;
>  #ifdef MEMORY_DYNAMIC
> -		kfree(tqe->buffer);
> +		kfree(rqe->buffer);
>  #endif
MEMORY_DYNAMIC is only used here and no where else. And buffer was
allocated in the else part of #ifdef MEMORY_STATIC.
So you should really be using #ifndef MEMORY_STATIC here instead of
#ifdef MEMORY_DYNAMIC otherwise memory leak will still remain.

regards
sudip

Re: [PATCH] staging: wicl1000: fix dereference after free in wilc_wlan_cleanup()

[Javier Martinez Canillas]

Hello Sudip,

Thanks a lot for your feedback.

On 09/22/2015 02:16 PM, Sudip Mukherjee wrote:
> On Tue, Sep 22, 2015 at 12:24:50PM +0200, Javier Martinez Canillas wrote:
>> The wilc_wlan_cleanup() function iterates over the list of transmission
>> buffers freeing all of them and then iterates over the receive buffers
>> list to free all of them as well.
>>
>> But on the receive loop a pointer to struct txq_entry_t is dereferenced
>> instead of the pointer to a struct rxq_entry_t. This not only causes a
>> dereference to a pointer already freed but also leaks the memory in the
>> struct rxq_entry_t buffer.
>>
>> Fixes: c5c77ba18ea6 ("staging: wilc1000: Add SDIO/SPI 802.11 driver")
>> Signed-off-by: Javier Martinez Canillas <javier@osg.samsung.com>
>>
>> ---
>>
>>  drivers/staging/wilc1000/wilc_wlan.c | 2 +-
>>  1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/drivers/staging/wilc1000/wilc_wlan.c b/drivers/staging/wilc1000/wilc_wlan.c
>> index 4c25179c2fec..c40f143b00b7 100644
>> --- a/drivers/staging/wilc1000/wilc_wlan.c
>> +++ b/drivers/staging/wilc1000/wilc_wlan.c
>> @@ -1746,7 +1746,7 @@ static void wilc_wlan_cleanup(void)
>>  		if (rqe == NULL)
>>  			break;
>>  #ifdef MEMORY_DYNAMIC
>> -		kfree(tqe->buffer);
>> +		kfree(rqe->buffer);
>>  #endif
> MEMORY_DYNAMIC is only used here and no where else. And buffer was
> allocated in the else part of #ifdef MEMORY_STATIC.
> So you should really be using #ifndef MEMORY_STATIC here instead of
> #ifdef MEMORY_DYNAMIC otherwise memory leak will still remain.
>

You are right that #ifndef MEMORY_STATIC should be used instead to fix
the memory leak. I'll post a v2 changing that as well.

> regards
> sudip
>

Best regards,
-- 
Javier Martinez Canillas
Open Source Group
Samsung Research America