From 9d4eed6837c014380d16ec6824b643d25731b927 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= Date: Mon, 7 Jan 2019 17:11:23 +0100 Subject: mac80211: brcmfmac: fix use-after-free & possible NULL pointer dereference MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 1) Using fwctx variable after brcmf_fw_request_done() was executed meant accessing freed memory. 2) Using fwctx->completion for the wait_for_completion_timeout() call could reuslt in NULL pointer dereference on fw loading error or if brcmf_fw_request_done() was executed quickly enough. Signed-off-by: Rafał Miłecki (cherry picked from commit 529c95cc15dc9fcc7709400cc921f2a3c03cd263) --- .../patches/860-brcmfmac-register-wiphy-s-during-module_init.patch | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/package/kernel/mac80211/patches/860-brcmfmac-register-wiphy-s-during-module_init.patch b/package/kernel/mac80211/patches/860-brcmfmac-register-wiphy-s-during-module_init.patch index 4f9d154b3f..bb059d1624 100644 --- a/package/kernel/mac80211/patches/860-brcmfmac-register-wiphy-s-during-module_init.patch +++ b/package/kernel/mac80211/patches/860-brcmfmac-register-wiphy-s-during-module_init.patch @@ -88,9 +88,9 @@ Signed-off-by: Rafał Miłecki GFP_KERNEL, fwctx, brcmf_fw_request_code_done); + if (!err) -+ wait_for_completion_timeout(fwctx->completion, ++ wait_for_completion_timeout(&completion, + msecs_to_jiffies(5000)); -+ fwctx->completion = NULL; ++ + return err; } -- cgit v1.2.3