* [PATCH] brcmfmac: Fix use after free in brcmf_sdio_readframes()
@ 2019-12-03 9:58 Dan Carpenter
2019-12-03 18:42 ` Franky Lin
2019-12-18 18:58 ` Kalle Valo
0 siblings, 2 replies; 3+ messages in thread
From: Dan Carpenter @ 2019-12-03 9:58 UTC (permalink / raw)
To: Arend van Spriel, Franky Lin
Cc: Hante Meuleman, Chi-Hsien Lin, Wright Feng, Kalle Valo,
Douglas Anderson, Ulf Hansson, Rafał Miłecki,
Naveen Gupta, linux-wireless, brcm80211-dev-list.pdl,
brcm80211-dev-list, kernel-janitors
The brcmu_pkt_buf_free_skb() function frees "pkt" so it leads to a
static checker warning:
drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c:1974 brcmf_sdio_readframes()
error: dereferencing freed memory 'pkt'
It looks like there was supposed to be a continue after we free "pkt".
Fixes: 4754fceeb9a6 ("brcmfmac: streamline SDIO read frame routine")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
Static analysis. Not tested.
drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
index 264ad63232f8..1dea0178832e 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
@@ -1935,6 +1935,7 @@ static uint brcmf_sdio_readframes(struct brcmf_sdio *bus, uint maxframes)
BRCMF_SDIO_FT_NORMAL)) {
rd->len = 0;
brcmu_pkt_buf_free_skb(pkt);
+ continue;
}
bus->sdcnt.rx_readahead_cnt++;
if (rd->len != roundup(rd_new.len, 16)) {
--
2.11.0
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH] brcmfmac: Fix use after free in brcmf_sdio_readframes()
2019-12-03 9:58 [PATCH] brcmfmac: Fix use after free in brcmf_sdio_readframes() Dan Carpenter
@ 2019-12-03 18:42 ` Franky Lin
2019-12-18 18:58 ` Kalle Valo
1 sibling, 0 replies; 3+ messages in thread
From: Franky Lin @ 2019-12-03 18:42 UTC (permalink / raw)
To: Dan Carpenter
Cc: Arend van Spriel, Franky Lin, Hante Meuleman, Chi-Hsien Lin,
Wright Feng, Kalle Valo, Douglas Anderson, Ulf Hansson,
Rafał Miłecki, Naveen Gupta,
open list:BROADCOM BRCM80211 IEEE802.11n WIRELESS DRIVER,
open list:BROADCOM BRCM80211 IEEE802.11n WIRELESS DRIVER,
brcm80211-dev-list, kernel-janitors
On Tue, Dec 3, 2019 at 1:59 AM Dan Carpenter <dan.carpenter@oracle.com> wrote:
>
> The brcmu_pkt_buf_free_skb() function frees "pkt" so it leads to a
> static checker warning:
>
> drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c:1974 brcmf_sdio_readframes()
> error: dereferencing freed memory 'pkt'
>
> It looks like there was supposed to be a continue after we free "pkt".
Good catch!
Acked-by: Franky Lin <franky.lin@broadcom.com>
>
> Fixes: 4754fceeb9a6 ("brcmfmac: streamline SDIO read frame routine")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> ---
> Static analysis. Not tested.
>
> drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
> index 264ad63232f8..1dea0178832e 100644
> --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
> +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
> @@ -1935,6 +1935,7 @@ static uint brcmf_sdio_readframes(struct brcmf_sdio *bus, uint maxframes)
> BRCMF_SDIO_FT_NORMAL)) {
> rd->len = 0;
> brcmu_pkt_buf_free_skb(pkt);
> + continue;
> }
> bus->sdcnt.rx_readahead_cnt++;
> if (rd->len != roundup(rd_new.len, 16)) {
> --
> 2.11.0
>
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH] brcmfmac: Fix use after free in brcmf_sdio_readframes()
2019-12-03 9:58 [PATCH] brcmfmac: Fix use after free in brcmf_sdio_readframes() Dan Carpenter
2019-12-03 18:42 ` Franky Lin
@ 2019-12-18 18:58 ` Kalle Valo
1 sibling, 0 replies; 3+ messages in thread
From: Kalle Valo @ 2019-12-18 18:58 UTC (permalink / raw)
To: Dan Carpenter
Cc: Arend van Spriel, Franky Lin, Hante Meuleman, Chi-Hsien Lin,
Wright Feng, Douglas Anderson, Ulf Hansson,
Rafał Miłecki, Naveen Gupta, linux-wireless,
brcm80211-dev-list.pdl, brcm80211-dev-list, kernel-janitors
Dan Carpenter <dan.carpenter@oracle.com> wrote:
> The brcmu_pkt_buf_free_skb() function frees "pkt" so it leads to a
> static checker warning:
>
> drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c:1974 brcmf_sdio_readframes()
> error: dereferencing freed memory 'pkt'
>
> It looks like there was supposed to be a continue after we free "pkt".
>
> Fixes: 4754fceeb9a6 ("brcmfmac: streamline SDIO read frame routine")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> Acked-by: Franky Lin <franky.lin@broadcom.com>
Patch applied to wireless-drivers-next.git, thanks.
216b44000ada brcmfmac: Fix use after free in brcmf_sdio_readframes()
--
https://patchwork.kernel.org/patch/11270885/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2019-12-18 18:58 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-12-03 9:58 [PATCH] brcmfmac: Fix use after free in brcmf_sdio_readframes() Dan Carpenter
2019-12-03 18:42 ` Franky Lin
2019-12-18 18:58 ` Kalle Valo
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).