From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Dan Carpenter <dan.carpenter@oracle.com>,
Franky Lin <franky.lin@broadcom.com>,
Kalle Valo <kvalo@codeaurora.org>,
Sasha Levin <sashal@kernel.org>,
linux-wireless@vger.kernel.org,
brcm80211-dev-list.pdl@broadcom.com,
brcm80211-dev-list@cypress.com, netdev@vger.kernel.org
Subject: [PATCH AUTOSEL 5.5 027/542] brcmfmac: Fix use after free in brcmf_sdio_readframes()
Date: Fri, 14 Feb 2020 10:40:19 -0500
Message-ID: <20200214154854.6746-27-sashal@kernel.org> (raw)
In-Reply-To: <20200214154854.6746-1-sashal@kernel.org>
From: Dan Carpenter <dan.carpenter@oracle.com>
[ Upstream commit 216b44000ada87a63891a8214c347e05a4aea8fe ]
The brcmu_pkt_buf_free_skb() function frees "pkt" so it leads to a
static checker warning:
drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c:1974 brcmf_sdio_readframes()
error: dereferencing freed memory 'pkt'
It looks like there was supposed to be a continue after we free "pkt".
Fixes: 4754fceeb9a6 ("brcmfmac: streamline SDIO read frame routine")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Franky Lin <franky.lin@broadcom.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
index 264ad63232f87..1dea0178832ea 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
@@ -1935,6 +1935,7 @@ static uint brcmf_sdio_readframes(struct brcmf_sdio *bus, uint maxframes)
BRCMF_SDIO_FT_NORMAL)) {
rd->len = 0;
brcmu_pkt_buf_free_skb(pkt);
+ continue;
}
bus->sdcnt.rx_readahead_cnt++;
if (rd->len != roundup(rd_new.len, 16)) {
--
2.20.1
next prev parent reply index
Thread overview: 30+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20200214154854.6746-1-sashal@kernel.org>
2020-02-14 15:39 ` [PATCH AUTOSEL 5.5 004/542] ath10k: Fix qmi init error handling Sasha Levin
2020-02-14 15:39 ` [PATCH AUTOSEL 5.5 005/542] wil6210: fix break that is never reached because of zero'ing of a retry counter Sasha Levin
2020-02-14 15:40 ` [PATCH AUTOSEL 5.5 026/542] brcmfmac: Fix memory leak in brcmf_p2p_create_p2pdev() Sasha Levin
2020-02-14 15:40 ` Sasha Levin [this message]
2020-02-14 15:41 ` [PATCH AUTOSEL 5.5 107/542] ath10k: Correct the DMA direction for management tx buffers Sasha Levin
2020-02-14 15:41 ` [PATCH AUTOSEL 5.5 109/542] rtw88: fix rate mask for 1SS chip Sasha Levin
2020-02-14 15:41 ` [PATCH AUTOSEL 5.5 110/542] brcmfmac: sdio: Fix OOB interrupt initialization on brcm43362 Sasha Levin
2020-02-14 15:41 ` [PATCH AUTOSEL 5.5 111/542] libertas: don't exit from lbs_ibss_join_existing() with RCU read lock held Sasha Levin
2020-02-14 15:41 ` [PATCH AUTOSEL 5.5 112/542] libertas: make lbs_ibss_join_existing() return error code on rates overflow Sasha Levin
2020-02-14 15:42 ` [PATCH AUTOSEL 5.5 132/542] mt76: mt7615: fix max_nss in mt7615_eeprom_parse_hw_cap Sasha Levin
2020-02-14 15:42 ` [PATCH AUTOSEL 5.5 167/542] ath10k: correct the tlv len of ath10k_wmi_tlv_op_gen_config_pno_start Sasha Levin
2020-02-14 15:43 ` [PATCH AUTOSEL 5.5 226/542] b43legacy: Fix -Wcast-function-type Sasha Levin
2020-02-14 15:43 ` [PATCH AUTOSEL 5.5 227/542] ipw2x00: " Sasha Levin
2020-02-14 15:43 ` [PATCH AUTOSEL 5.5 228/542] iwlegacy: " Sasha Levin
2020-02-14 15:43 ` [PATCH AUTOSEL 5.5 229/542] rtlwifi: rtl_pci: " Sasha Levin
2020-02-14 15:43 ` [PATCH AUTOSEL 5.5 230/542] bcma: remove set but not used variable 'sizel' Sasha Levin
2020-02-14 15:43 ` [PATCH AUTOSEL 5.5 231/542] orinoco: avoid assertion in case of NULL pointer Sasha Levin
2020-02-14 15:47 ` [PATCH AUTOSEL 5.5 471/542] ath10k: pci: Only dump ATH10K_MEM_REGION_TYPE_IOREG when safe Sasha Levin
2020-02-14 15:47 ` [PATCH AUTOSEL 5.5 472/542] hostap: Adjust indentation in prism2_hostapd_add_sta Sasha Levin
2020-02-14 15:47 ` [PATCH AUTOSEL 5.5 473/542] rtw88: fix potential NULL skb access in TX ISR Sasha Levin
2020-02-14 15:47 ` [PATCH AUTOSEL 5.5 474/542] rtlwifi: rtl8821ae: remove unused variables Sasha Levin
2020-02-14 15:47 ` [PATCH AUTOSEL 5.5 475/542] rtlwifi: rtl8192ee: " Sasha Levin
2020-02-14 15:47 ` [PATCH AUTOSEL 5.5 476/542] rtlwifi: rtl8723ae: " Sasha Levin
2020-02-14 15:47 ` [PATCH AUTOSEL 5.5 477/542] iwlegacy: ensure loop counter addr does not wrap and cause an infinite loop Sasha Levin
2020-02-14 15:47 ` [PATCH AUTOSEL 5.5 484/542] mwifiex: Fix possible buffer overflows in mwifiex_ret_wmm_get_status() Sasha Levin
2020-02-14 15:47 ` [PATCH AUTOSEL 5.5 485/542] mwifiex: Fix possible buffer overflows in mwifiex_cmd_append_vsie_tlv() Sasha Levin
2020-02-14 15:48 ` [PATCH AUTOSEL 5.5 516/542] iwlwifi: mvm: Fix thermal zone registration Sasha Levin
2020-02-14 15:48 ` [PATCH AUTOSEL 5.5 517/542] iwlwifi: mvm: avoid use after free for pmsr request Sasha Levin
2020-02-14 15:48 ` [PATCH AUTOSEL 5.5 518/542] iwlwifi: mvm: Check the sta is not NULL in iwl_mvm_cfg_he_sta() Sasha Levin
2020-02-14 15:48 ` [PATCH AUTOSEL 5.5 519/542] iwlwifi: mvm: fix TDLS discovery with the new firmware API Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200214154854.6746-27-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=brcm80211-dev-list.pdl@broadcom.com \
--cc=brcm80211-dev-list@cypress.com \
--cc=dan.carpenter@oracle.com \
--cc=franky.lin@broadcom.com \
--cc=kvalo@codeaurora.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-wireless@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Linux-Wireless Archive on lore.kernel.org
Archives are clonable:
git clone --mirror https://lore.kernel.org/linux-wireless/0 linux-wireless/git/0.git
# If you have public-inbox 1.1+ installed, you may
# initialize and index your mirror using the following commands:
public-inbox-init -V2 linux-wireless linux-wireless/ https://lore.kernel.org/linux-wireless \
linux-wireless@vger.kernel.org
public-inbox-index linux-wireless
Example config snippet for mirrors
Newsgroup available over NNTP:
nntp://nntp.lore.kernel.org/org.kernel.vger.linux-wireless
AGPL code for this site: git clone https://public-inbox.org/public-inbox.git