mirror of
https://git.proxmox.com/git/mirror_ubuntu-kernels.git
synced 2025-11-30 08:17:48 +00:00
4f68ef64cd
The function cw1200_bss_info_changed() and cw1200_hw_scan() can be concurrently executed. The two functions both access a possible shared variable "frame.skb". This shared variable is freed by dev_kfree_skb() in cw1200_upload_beacon(), which is called by cw1200_bss_info_changed(). The free operation is protected by a mutex lock "priv->conf_mutex" in cw1200_bss_info_changed(). In cw1200_hw_scan(), this shared variable is accessed without the protection of the mutex lock "priv->conf_mutex". Thus, concurrency use-after-free bugs may occur. To fix these bugs, the original calls to mutex_lock(&priv->conf_mutex) and mutex_unlock(&priv->conf_mutex) are moved to the places, which can protect the accesses to the shared variable. Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> |
||
|---|---|---|
| .. | ||
| bh.c | ||
| bh.h | ||
| cw1200_sdio.c | ||
| cw1200_spi.c | ||
| cw1200.h | ||
| debug.c | ||
| debug.h | ||
| fwio.c | ||
| fwio.h | ||
| hwbus.h | ||
| hwio.c | ||
| hwio.h | ||
| Kconfig | ||
| main.c | ||
| Makefile | ||
| pm.c | ||
| pm.h | ||
| queue.c | ||
| queue.h | ||
| scan.c | ||
| scan.h | ||
| sta.c | ||
| sta.h | ||
| txrx.c | ||
| txrx.h | ||
| wsm.c | ||
| wsm.h | ||