lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

libertas: fix use-after-free error

Browse Source 
Previously, the display of subscribed events could be wrong.

Signed-off-by: Holger Schurig <hs4233@mail.mn-solutions.de>
Signed-off-by: David Woodhouse <dwmw2@infradead.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
This commit is contained in:
Holger Schurig
2007-12-10 12:19:55 +01:00
committed by David S. Miller
parent c3f949618d
commit b6b8abe4dd
1 changed files with 8 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
drivers/net/wireless/libertas/debugfs.c
View File

@@ -410,30 +410,32 @@ static ssize_t lbs_threshold_read(
char *buf = (char *)addr; char *buf = (char *)addr;
u8 value; u8 value;
u8 freq; u8 freq;
int events = 0;
struct cmd_ds_802_11_subscribe_event *events = kzalloc( struct cmd_ds_802_11_subscribe_event *subscribed = kzalloc(
sizeof(struct cmd_ds_802_11_subscribe_event), sizeof(struct cmd_ds_802_11_subscribe_event),
GFP_KERNEL); GFP_KERNEL);
struct mrvlietypes_thresholds *got; struct mrvlietypes_thresholds *got;
res = lbs_prepare_and_send_command(priv, res = lbs_prepare_and_send_command(priv,
CMD_802_11_SUBSCRIBE_EVENT, CMD_ACT_GET, CMD_802_11_SUBSCRIBE_EVENT, CMD_ACT_GET,
CMD_OPTION_WAITFORRSP, 0, events); CMD_OPTION_WAITFORRSP, 0, subscribed);
if (res) { if (res) {
kfree(events); kfree(subscribed);
return res; return res;
} }
got = lbs_tlv_find(tlv_type, events->tlv, sizeof(events->tlv)); got = lbs_tlv_find(tlv_type, subscribed->tlv, sizeof(subscribed->tlv));
if (got) { if (got) {
value = got->value; value = got->value;
freq = got->freq; freq = got->freq;
events = le16_to_cpu(subscribed->events);
} }
kfree(events); kfree(subscribed);
if (got) if (got)
pos += snprintf(buf, len, "%d %d %d\n", value, freq, pos += snprintf(buf, len, "%d %d %d\n", value, freq,
!!(le16_to_cpu(events->events) & event_mask)); !!(events & event_mask));
res = simple_read_from_buffer(userbuf, count, ppos, buf, pos); res = simple_read_from_buffer(userbuf, count, ppos, buf, pos);