bcm43xx-d80211: Fix DMA TX skb doublefree

PATCH RESEND New Michael Buesch 1 participant 1 message Jan 23, 2007

Subsystems (3)

Networking Network drivers Networking drivers (wireless)

lore

Share & tools

lore

Michael Buesch

author

2007-01-23 16:45 UTC #0 lore raw

PATCH RESEND 1/1 bcm43xx-d80211: Fix DMA TX skb doublefree

This fixes a possible double-free of the TX skb buffers. Always NULL the pointer after freeing.

Signed-off-by Michael Buesch <[email protected]>

I already sent this patch to you on 21 Dec 2006. This is a pretty critical patch, so I'd like to make sure it's in your merge queue and is not lost.

drivers/net/wireless/d80211/bcm43xx/bcm43xx_dma.c +2 -0

Index: wireless-dev/drivers/net/wireless/d80211/bcm43xx/bcm43xx_dma.c
===================================================================
@@ -388,6 +388,7 @@ void free_descriptor_buffer(struct bcm43
 			dev_kfree_skb_irq(meta->skb);
 		else
 			dev_kfree_skb(meta->skb);
+		meta->skb = NULL;
 	}
 }

@@ -1131,6 +1132,7 @@ void bcm43xx_dma_handle_txstatus(struct 
 			meta->txstat.retry_count = status->frame_count - 1;
 			ieee80211_tx_status_irqsafe(bcm->ieee, meta->skb, &(meta->txstat));
 			/* skb is freed by ieee80211_tx_status_irqsafe() */
+			meta->skb = NULL;
 		} else {
 			/* No need to call free_descriptor_buffer here, as
 			 * this is only the txhdr, which is not allocated.

Signature · 1 line

Greetings Michael.