* [PATCH] bcm43xx_d80211: Fix major memory corruption bug
@ 2007-01-21 5:27 Pavel Roskin
2007-01-22 18:21 ` Michael Buesch
2007-01-23 10:06 ` Michael Buesch
0 siblings, 2 replies; 3+ messages in thread
From: Pavel Roskin @ 2007-01-21 5:27 UTC (permalink / raw)
To: netdev; +Cc: Michael Buesch
Set phy->lo_control to NULL whenever it's freed. Failure to do so leads
to zeroing a block of memory that uses to hold *phy->lo_control, which
caused random crashes down the road.
Signed-off-by: Pavel Roskin <proski@gnu.org>
---
drivers/net/wireless/d80211/bcm43xx/bcm43xx_main.c | 2 ++
1 files changed, 2 insertions(+), 0 deletions(-)
diff --git a/drivers/net/wireless/d80211/bcm43xx/bcm43xx_main.c b/drivers/net/wireless/d80211/bcm43xx/bcm43xx_main.c
index 3064322..62d4dc9 100644
--- a/drivers/net/wireless/d80211/bcm43xx/bcm43xx_main.c
+++ b/drivers/net/wireless/d80211/bcm43xx/bcm43xx_main.c
@@ -3048,6 +3048,7 @@ static void bcm43xx_wireless_core_exit(struct bcm43xx_wldev *dev)
if (phy->dyn_tssi_tbl)
kfree(phy->tssi2dbm);
kfree(phy->lo_control);
+ phy->lo_control = NULL;
ssb_chipco_set_clockmode(chipco, SSB_CLKMODE_SLOW);
bcm43xx_vstack_free(&dev->genstack);
bcm43xx_set_status(dev, BCM43xx_STAT_UNINIT);
@@ -3179,6 +3180,7 @@ err_kfree_tssitbl:
kfree(phy->tssi2dbm);
err_kfree_lo_control:
kfree(phy->lo_control);
+ phy->lo_control = NULL;
err_slowclock:
ssb_chipco_set_clockmode(chipco, SSB_CLKMODE_SLOW);
bcm43xx_set_status(dev, BCM43xx_STAT_UNINIT);
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] bcm43xx_d80211: Fix major memory corruption bug
2007-01-21 5:27 [PATCH] bcm43xx_d80211: Fix major memory corruption bug Pavel Roskin
@ 2007-01-22 18:21 ` Michael Buesch
2007-01-23 10:06 ` Michael Buesch
1 sibling, 0 replies; 3+ messages in thread
From: Michael Buesch @ 2007-01-22 18:21 UTC (permalink / raw)
To: Pavel Roskin; +Cc: netdev
On Sunday 21 January 2007 06:27, Pavel Roskin wrote:
> Set phy->lo_control to NULL whenever it's freed. Failure to do so leads
> to zeroing a block of memory that uses to hold *phy->lo_control, which
> caused random crashes down the road.
>
> Signed-off-by: Pavel Roskin <proski@gnu.org>
Good catch. Thanks.
> ---
>
> drivers/net/wireless/d80211/bcm43xx/bcm43xx_main.c | 2 ++
> 1 files changed, 2 insertions(+), 0 deletions(-)
>
> diff --git a/drivers/net/wireless/d80211/bcm43xx/bcm43xx_main.c b/drivers/net/wireless/d80211/bcm43xx/bcm43xx_main.c
> index 3064322..62d4dc9 100644
> --- a/drivers/net/wireless/d80211/bcm43xx/bcm43xx_main.c
> +++ b/drivers/net/wireless/d80211/bcm43xx/bcm43xx_main.c
> @@ -3048,6 +3048,7 @@ static void bcm43xx_wireless_core_exit(struct bcm43xx_wldev *dev)
> if (phy->dyn_tssi_tbl)
> kfree(phy->tssi2dbm);
> kfree(phy->lo_control);
> + phy->lo_control = NULL;
> ssb_chipco_set_clockmode(chipco, SSB_CLKMODE_SLOW);
> bcm43xx_vstack_free(&dev->genstack);
> bcm43xx_set_status(dev, BCM43xx_STAT_UNINIT);
> @@ -3179,6 +3180,7 @@ err_kfree_tssitbl:
> kfree(phy->tssi2dbm);
> err_kfree_lo_control:
> kfree(phy->lo_control);
> + phy->lo_control = NULL;
> err_slowclock:
> ssb_chipco_set_clockmode(chipco, SSB_CLKMODE_SLOW);
> bcm43xx_set_status(dev, BCM43xx_STAT_UNINIT);
>
>
>
--
Greetings Michael.
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] bcm43xx_d80211: Fix major memory corruption bug
2007-01-21 5:27 [PATCH] bcm43xx_d80211: Fix major memory corruption bug Pavel Roskin
2007-01-22 18:21 ` Michael Buesch
@ 2007-01-23 10:06 ` Michael Buesch
1 sibling, 0 replies; 3+ messages in thread
From: Michael Buesch @ 2007-01-23 10:06 UTC (permalink / raw)
To: Pavel Roskin; +Cc: netdev
On Sunday 21 January 2007 06:27, Pavel Roskin wrote:
> Set phy->lo_control to NULL whenever it's freed. Failure to do so leads
> to zeroing a block of memory that uses to hold *phy->lo_control, which
> caused random crashes down the road.
>
> Signed-off-by: Pavel Roskin <proski@gnu.org>
Applied, thanks.
> ---
>
> drivers/net/wireless/d80211/bcm43xx/bcm43xx_main.c | 2 ++
> 1 files changed, 2 insertions(+), 0 deletions(-)
>
> diff --git a/drivers/net/wireless/d80211/bcm43xx/bcm43xx_main.c b/drivers/net/wireless/d80211/bcm43xx/bcm43xx_main.c
> index 3064322..62d4dc9 100644
> --- a/drivers/net/wireless/d80211/bcm43xx/bcm43xx_main.c
> +++ b/drivers/net/wireless/d80211/bcm43xx/bcm43xx_main.c
> @@ -3048,6 +3048,7 @@ static void bcm43xx_wireless_core_exit(struct bcm43xx_wldev *dev)
> if (phy->dyn_tssi_tbl)
> kfree(phy->tssi2dbm);
> kfree(phy->lo_control);
> + phy->lo_control = NULL;
> ssb_chipco_set_clockmode(chipco, SSB_CLKMODE_SLOW);
> bcm43xx_vstack_free(&dev->genstack);
> bcm43xx_set_status(dev, BCM43xx_STAT_UNINIT);
> @@ -3179,6 +3180,7 @@ err_kfree_tssitbl:
> kfree(phy->tssi2dbm);
> err_kfree_lo_control:
> kfree(phy->lo_control);
> + phy->lo_control = NULL;
> err_slowclock:
> ssb_chipco_set_clockmode(chipco, SSB_CLKMODE_SLOW);
> bcm43xx_set_status(dev, BCM43xx_STAT_UNINIT);
>
>
>
--
Greetings Michael.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2007-01-23 10:08 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2007-01-21 5:27 [PATCH] bcm43xx_d80211: Fix major memory corruption bug Pavel Roskin
2007-01-22 18:21 ` Michael Buesch
2007-01-23 10:06 ` Michael Buesch
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).