[PATCH v2] staging: wicl1000: fix dereference after free in wilc_wlan_cleanup()

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



The wilc_wlan_cleanup() function iterates over the list of transmission
buffers freeing all of them and then iterates over the receive buffers
list to free all of them as well.

But on the receive loop a pointer to struct txq_entry_t is dereferenced
instead of the pointer to a struct rxq_entry_t. This not only causes a
dereference to a pointer already freed but also leaks the memory in the
struct rxq_entry_t buffer.

Also, the buffer is allocated when MEMORY_STATIC is not defined no when
MEMORY_DYNAMIC is defined. So use #ifndef MEMORY_STATIC instead as it's
done in the rest of the driver to avoid leaking the buffer memory.

Fixes: c5c77ba18ea6 ("staging: wilc1000: Add SDIO/SPI 802.11 driver")
Signed-off-by: Javier Martinez Canillas <javier@xxxxxxxxxxxxxxx>

---

Changes in v2:
- Change also the #ifdef MEMORY_DYNAMIC to #ifndef MEMORY_STATIC since buffer
  is allocated when MEMORY_STATIC isn't defined. Suggested by Sudip Mukherjee.

 drivers/staging/wilc1000/wilc_wlan.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/staging/wilc1000/wilc_wlan.c b/drivers/staging/wilc1000/wilc_wlan.c
index 4c25179c2fec..fc9028d59dcd 100644
--- a/drivers/staging/wilc1000/wilc_wlan.c
+++ b/drivers/staging/wilc1000/wilc_wlan.c
@@ -1745,8 +1745,8 @@ static void wilc_wlan_cleanup(void)
 		rqe = wilc_wlan_rxq_remove();
 		if (rqe == NULL)
 			break;
-#ifdef MEMORY_DYNAMIC
-		kfree(tqe->buffer);
+#ifndef MEMORY_STATIC
+		kfree(rqe->buffer);
 #endif
 		kfree(rqe);
 	} while (1);
-- 
2.4.3

_______________________________________________
devel mailing list
devel@xxxxxxxxxxxxxxxxxxxxxx
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel



[Index of Archives]     [Linux Driver Backports]     [DMA Engine]     [Linux GPIO]     [Linux SPI]     [Video for Linux]     [Linux USB Devel]     [Linux Coverity]     [Linux Audio Users]     [Linux Kernel]     [Linux SCSI]     [Yosemite Backpacking]
  Powered by Linux