redonkable
/
alistair23-linux
1
0
Fork 0
Code Releases Activity

mwifiex: Fix an issue spotted by KASAN 

When an association command is sent to firmware but the process is
killed before the command response arrives, driver will try to
access bss_desc which is already freed. This issue is fixed by
checking return value of bss_start.

Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
hifive-unleashed-5.1
Ganapathi Bhat 2016-06-16 18:52:21 +05:30 committed by Kalle Valo
parent 08aba42fcc
commit 4699fc3f2d
2 changed files with 16 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
drivers/net/wireless/marvell/mwifiex/join.c
View File

@ -647,6 +647,12 @@ int mwifiex_ret_802_11_associate(struct mwifiex_private *priv,
const u8 *ie_ptr;
struct ieee80211_ht_operation *assoc_resp_ht_oper;
if (!priv->attempted_bss_desc) {
mwifiex_dbg(priv->adapter, ERROR,
"ASSOC_RESP: failed, association terminated by host\n");
goto done;
}
assoc_rsp = (struct ieee_types_assoc_rsp *) &resp->params;
cap_info = le16_to_cpu(assoc_rsp->cap_info_bitmap);
@ -1270,6 +1276,12 @@ int mwifiex_ret_802_11_ad_hoc(struct mwifiex_private *priv,
u16 cmd = le16_to_cpu(resp->command);
u8 result;
if (!priv->attempted_bss_desc) {
mwifiex_dbg(priv->adapter, ERROR,
"ADHOC_RESP: failed, association terminated by host\n");
goto done;
}
if (cmd == HostCmd_CMD_802_11_AD_HOC_START)
result = start_result->result;
else

4
drivers/net/wireless/marvell/mwifiex/sta_ioctl.c
View File

@ -426,6 +426,10 @@ done:
if (bss_desc)
kfree(bss_desc->beacon_buf);
kfree(bss_desc);
if (ret < 0)
priv->attempted_bss_desc = NULL;
return ret;
}