Search Linux Wireless

Re: [PATCH] ath9k: fix access to freed data on unload

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Sat, Jan 30, 2010 at 6:37 PM, Pavel Roskin <proski@xxxxxxx> wrote:
> Calling ath_bus_cleanup() after ieee80211_free_hw() resulted in access
> to common->bus_ops, which is already freed as part of the device data.
>
> Remove the cleanup field in struct ath_bus_ops, as it was never used
> properly.  Remove ath_bus_cleanup().  Merge cleanup functions in place
> of the ath_bus_cleanup() calls.  Take care not to use any device data
> after ieee80211_free_hw().
>
> Signed-off-by: Pavel Roskin <proski@xxxxxxx>
> ---
>
> The bug was causing a hang on a kernel with most debugging options
> enabled.  I think the fix is important and simple enough for stable
> kernels.  I wish I could make the patch smaller, but I didn't want to
> leave unused and dangerous fields and functions.
>
> ath9k was tested on the PCI bus.  ath9k on AHB was compile tested.
> ath5k and ar9170 use struct ath_bus_ops, but don't use the cleanup
> field, so they are not affected.

Thanks, can you please resend with a Cc: stable@xxxxxxxxxx on the commit log?

  Luis
--
To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[Index of Archives]     [Linux Host AP]     [ATH6KL]     [Linux Bluetooth]     [Linux Netdev]     [Kernel Newbies]     [Linux Kernel]     [IDE]     [Security]     [Git]     [Netfilter]     [Bugtraq]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Linux ATA RAID]     [Samba]     [Device Mapper]
  Powered by Linux