Skip to contentSkip to conversation

bcm43xx_d80211: Fix major memory corruption bug

PATCH Applied Pavel Roskin 2 participants 3 messages Jan 21, 2007 – Jan 23, 2007

Subsystems (3)
Networking Network drivers Networking drivers (wireless)
lore
Share & tools
lore

Pavel Roskin

author
#0 lore raw

PATCH 1/1 bcm43xx_d80211: Fix major memory corruption bug

Set phy->lo_control to NULL whenever it's freed. Failure to do so leads to zeroing a block of memory that uses to hold *phy->lo_control, which caused random crashes down the road.

Signed-off-by Pavel Roskin <[email protected]>

---

 drivers/net/wireless/d80211/bcm43xx/bcm43xx_main.c |    2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)
drivers/net/wireless/d80211/bcm43xx/bcm43xx_main.c +2 -0
index 3064322..62d4dc9 100644
@@ -3048,6 +3048,7 @@ static void bcm43xx_wireless_core_exit(struct bcm43xx_wldev *dev)
 	if (phy->dyn_tssi_tbl)
 		kfree(phy->tssi2dbm);
 	kfree(phy->lo_control);
+	phy->lo_control = NULL;
 	ssb_chipco_set_clockmode(chipco, SSB_CLKMODE_SLOW);
 	bcm43xx_vstack_free(&dev->genstack);
 	bcm43xx_set_status(dev, BCM43xx_STAT_UNINIT);

@@ -3179,6 +3180,7 @@ err_kfree_tssitbl:
 		kfree(phy->tssi2dbm);
 err_kfree_lo_control:
 	kfree(phy->lo_control);
+	phy->lo_control = NULL;
 err_slowclock:
 	ssb_chipco_set_clockmode(chipco, SSB_CLKMODE_SLOW);
 	bcm43xx_set_status(dev, BCM43xx_STAT_UNINIT);
#1 lore raw
Quoted 5 lines · Pavel Roskin

Set phy->lo_control to NULL whenever it's freed. Failure to do so leads to zeroing a block of memory that uses to hold *phy->lo_control, which caused random crashes down the road.

Signed-off-by Pavel Roskin <[email protected]>

Good catch. Thanks.

Quoted 28 lines

---

 drivers/net/wireless/d80211/bcm43xx/bcm43xx_main.c |    2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)
drivers/net/wireless/d80211/bcm43xx/bcm43xx_main.c +2 -0
index 3064322..62d4dc9 100644
@@ -3048,6 +3048,7 @@ static void bcm43xx_wireless_core_exit(struct bcm43xx_wldev *dev)
 	if (phy->dyn_tssi_tbl)
 		kfree(phy->tssi2dbm);
 	kfree(phy->lo_control);
+	phy->lo_control = NULL;
 	ssb_chipco_set_clockmode(chipco, SSB_CLKMODE_SLOW);
 	bcm43xx_vstack_free(&dev->genstack);
 	bcm43xx_set_status(dev, BCM43xx_STAT_UNINIT);

@@ -3179,6 +3180,7 @@ err_kfree_tssitbl:
 		kfree(phy->tssi2dbm);
 err_kfree_lo_control:
 	kfree(phy->lo_control);
+	phy->lo_control = NULL;
 err_slowclock:
 	ssb_chipco_set_clockmode(chipco, SSB_CLKMODE_SLOW);
 	bcm43xx_set_status(dev, BCM43xx_STAT_UNINIT);
Signature · 1 line
Greetings Michael.
Applied
#2 lore raw
In reply to Pavel Roskin
Quoted 5 lines · Pavel Roskin

Set phy->lo_control to NULL whenever it's freed. Failure to do so leads to zeroing a block of memory that uses to hold *phy->lo_control, which caused random crashes down the road.

Signed-off-by Pavel Roskin <[email protected]>

Applied, thanks.

Quoted 28 lines

---

 drivers/net/wireless/d80211/bcm43xx/bcm43xx_main.c |    2 ++
 1 files changed, 2 insertions(+), 0 deletions(-)
drivers/net/wireless/d80211/bcm43xx/bcm43xx_main.c +2 -0
index 3064322..62d4dc9 100644
@@ -3048,6 +3048,7 @@ static void bcm43xx_wireless_core_exit(struct bcm43xx_wldev *dev)
 	if (phy->dyn_tssi_tbl)
 		kfree(phy->tssi2dbm);
 	kfree(phy->lo_control);
+	phy->lo_control = NULL;
 	ssb_chipco_set_clockmode(chipco, SSB_CLKMODE_SLOW);
 	bcm43xx_vstack_free(&dev->genstack);
 	bcm43xx_set_status(dev, BCM43xx_STAT_UNINIT);

@@ -3179,6 +3180,7 @@ err_kfree_tssitbl:
 		kfree(phy->tssi2dbm);
 err_kfree_lo_control:
 	kfree(phy->lo_control);
+	phy->lo_control = NULL;
 err_slowclock:
 	ssb_chipco_set_clockmode(chipco, SSB_CLKMODE_SLOW);
 	bcm43xx_set_status(dev, BCM43xx_STAT_UNINIT);
Signature · 1 line
Greetings Michael.