Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d0aac714 authored by Dan Carpenter's avatar Dan Carpenter Committed by Greg Kroah-Hartman
Browse files

staging: rtl8712: fix use after free bugs 



commit e230a4455ac3e9b112f0367d1b8e255e141afae0 upstream.

_Read/Write_MACREG callbacks are NULL so the read/write_macreg_hdl()
functions don't do anything except free the "pcmd" pointer.  It
results in a use after free.  Delete them.

Fixes: 2865d42c ("staging: r8712u: Add the new driver to the mainline kernel")
Cc: stable <stable@kernel.org>
Reported-by: default avatarZheng Wang <hackerzheng666@gmail.com>
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/Yw4ASqkYcUhUfoY2@kili


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent a65a2a33

drivers/staging/rtl8712/rtl8712_cmd.c

+0 −36
Original line number Diff line number Diff line
@@ -117,34 +117,6 @@ static void r871x_internal_cmd_hdl(struct _adapter *padapter, u8 *pbuf) 
	kfree(pdrvcmd->pbuf);

}



static u8 read_macreg_hdl(struct _adapter *padapter, u8 *pbuf)

{

	void (*pcmd_callback)(struct _adapter *dev, struct cmd_obj	*pcmd);

	struct cmd_obj *pcmd  = (struct cmd_obj *)pbuf;



	/*  invoke cmd->callback function */

	pcmd_callback = cmd_callback[pcmd->cmdcode].callback;

	if (!pcmd_callback)

		r8712_free_cmd_obj(pcmd);

	else

		pcmd_callback(padapter, pcmd);

	return H2C_SUCCESS;

}



static u8 write_macreg_hdl(struct _adapter *padapter, u8 *pbuf)

{

	void (*pcmd_callback)(struct _adapter *dev, struct cmd_obj	*pcmd);

	struct cmd_obj *pcmd  = (struct cmd_obj *)pbuf;



	/*  invoke cmd->callback function */

	pcmd_callback = cmd_callback[pcmd->cmdcode].callback;

	if (!pcmd_callback)

		r8712_free_cmd_obj(pcmd);

	else

		pcmd_callback(padapter, pcmd);

	return H2C_SUCCESS;

}



static u8 read_bbreg_hdl(struct _adapter *padapter, u8 *pbuf)

{

	struct cmd_obj *pcmd  = (struct cmd_obj *)pbuf;
@@ -213,14 +185,6 @@ static struct cmd_obj *cmd_hdl_filter(struct _adapter *padapter, 
	pcmd_r = NULL;



	switch (pcmd->cmdcode) {

	case GEN_CMD_CODE(_Read_MACREG):

		read_macreg_hdl(padapter, (u8 *)pcmd);

		pcmd_r = pcmd;

		break;

	case GEN_CMD_CODE(_Write_MACREG):

		write_macreg_hdl(padapter, (u8 *)pcmd);

		pcmd_r = pcmd;

		break;

	case GEN_CMD_CODE(_Read_BBREG):

		read_bbreg_hdl(padapter, (u8 *)pcmd);

		break;