ExternalVendorCode/openwrt
1
0
Fork 0
mirror of https://github.com/openwrt/openwrt.git synced 2025-03-12 23:44:26 +00:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

mac80211: brcmfmac: fix use-after-free & possible NULL pointer dereference

Browse Source 
1) Using fwctx variable after brcmf_fw_request_done() was executed meant
   accessing freed memory.
2) Using fwctx->completion for the wait_for_completion_timeout() call
   could reuslt in NULL pointer dereference on fw loading error or if
   brcmf_fw_request_done() was executed quickly enough.

Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
(cherry picked from commit 529c95cc15dc9fcc7709400cc921f2a3c03cd263)
This commit is contained in:
Rafał Miłecki 2019-01-07 17:11:23 +01:00
parent 834bd86424
commit 9d4eed6837
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
package/kernel/mac80211/patches/860-brcmfmac-register-wiphy-s-during-module_init.patch
View File

@ -88,9 +88,9 @@ Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
GFP_KERNEL, fwctx, GFP_KERNEL, fwctx,
brcmf_fw_request_code_done); brcmf_fw_request_code_done);
+ if (!err) + if (!err)
+ wait_for_completion_timeout(fwctx->completion, + wait_for_completion_timeout(&completion,
+ msecs_to_jiffies(5000)); + msecs_to_jiffies(5000));
+ fwctx->completion = NULL; +
+ return err; + return err;
} }