Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b6b8abe4 authored by Holger Schurig's avatar Holger Schurig Committed by David S. Miller
Browse files

libertas: fix use-after-free error 



Previously, the display of subscribed events could be wrong.

Signed-off-by: default avatarHolger Schurig <hs4233@mail.mn-solutions.de>
Signed-off-by: default avatarDavid Woodhouse <dwmw2@infradead.org>
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent c3f94961

drivers/net/wireless/libertas/debugfs.c

+8 −6
Original line number Diff line number Diff line
@@ -410,30 +410,32 @@ static ssize_t lbs_threshold_read( 
	char *buf = (char *)addr;

	u8 value;

	u8 freq;

	int events = 0;



	struct cmd_ds_802_11_subscribe_event *events = kzalloc(

	struct cmd_ds_802_11_subscribe_event *subscribed = kzalloc(

		sizeof(struct cmd_ds_802_11_subscribe_event),

		GFP_KERNEL);

	struct mrvlietypes_thresholds *got;



	res = lbs_prepare_and_send_command(priv,

			CMD_802_11_SUBSCRIBE_EVENT, CMD_ACT_GET,

			CMD_OPTION_WAITFORRSP, 0, events);

			CMD_OPTION_WAITFORRSP, 0, subscribed);

	if (res) {

		kfree(events);

		kfree(subscribed);

		return res;

	}



	got = lbs_tlv_find(tlv_type, events->tlv, sizeof(events->tlv));

	got = lbs_tlv_find(tlv_type, subscribed->tlv, sizeof(subscribed->tlv));

	if (got) {

		value = got->value;

		freq  = got->freq;

		events = le16_to_cpu(subscribed->events);

	}

	kfree(events);

	kfree(subscribed);



	if (got)

		pos += snprintf(buf, len, "%d %d %d\n", value, freq,

			!!(le16_to_cpu(events->events) & event_mask));

			!!(events & event_mask));



	res = simple_read_from_buffer(userbuf, count, ppos, buf, pos);