On Thu, May 17, 2012 at 10:47 PM, Johannes Berg <johannes@xxxxxxxxxxxxxxxx> wrote: > On Thu, 2012-05-17 at 19:06 +0300, Eliad Peller wrote: >> cfg80211_dev_free() calls cfg80211_put_bss() directly on all >> the remaining bss entries, skipping the proper bss entry >> cleanup that usually made by __cfg80211_unlink_bss(), and >> leaving the bss_list and the rb_tree with dangling pointers. > >> list_for_each_entry_safe(scan, tmp, &rdev->bss_list, list) >> - cfg80211_put_bss(&scan->pub); >> + cfg80211_unlink_bss(&rdev->wiphy, &scan->pub); >> kfree(rdev); > > I don't see why we care, we free rdev anyway. > yeah, you have a point here... we got a crash report for an older kernel with some custom patches, that indicated a possible write-after-free on the bss release. i was probably too rushed to blame this code. thanks, Eliad. -- To unsubscribe from this list: send the line "unsubscribe linux-wireless" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
