mirror of
https://github.com/openwrt/openwrt.git
synced 2024-12-29 18:19:02 +00:00
32 lines
1.2 KiB
Diff
32 lines
1.2 KiB
Diff
|
From 216b44000ada87a63891a8214c347e05a4aea8fe Mon Sep 17 00:00:00 2001
|
||
|
|
From: Dan Carpenter <dan.carpenter@oracle.com>
|
||
|
|
Date: Tue, 3 Dec 2019 12:58:55 +0300
|
||
|
|
Subject: [PATCH] brcmfmac: Fix use after free in brcmf_sdio_readframes()
|
||
|
|
|
||
|
|
The brcmu_pkt_buf_free_skb() function frees "pkt" so it leads to a
|
||
|
|
static checker warning:
|
||
|
|
|
||
|
|
drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c:1974 brcmf_sdio_readframes()
|
||
|
|
error: dereferencing freed memory 'pkt'
|
||
|
|
|
||
|
|
It looks like there was supposed to be a continue after we free "pkt".
|
||
|
|
|
||
|
|
Fixes: 4754fceeb9a6 ("brcmfmac: streamline SDIO read frame routine")
|
||
|
|
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
|
||
|
|
Acked-by: Franky Lin <franky.lin@broadcom.com>
|
||
|
|
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
|
||
|
|
---
|
||
|
|
drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 1 +
|
||
|
|
1 file changed, 1 insertion(+)
|
||
|
|
|
||
|
|
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
|
||
|
|
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
|
||
|
|
@@ -1935,6 +1935,7 @@ static uint brcmf_sdio_readframes(struct
|
||
|
|
BRCMF_SDIO_FT_NORMAL)) {
|
||
|
|
rd->len = 0;
|
||
|
|
brcmu_pkt_buf_free_skb(pkt);
|
||
|
|
+ continue;
|
||
|
|
}
|
||
|
|
bus->sdcnt.rx_readahead_cnt++;
|
||
|
|
if (rd->len != roundup(rd_new.len, 16)) {
|