Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 135739e1 authored by Zhu Jianmin's avatar Zhu Jianmin Committed by Gerrit - the friendly Code Review server
Browse files

cfg80211: Fix use after free when process wdev events 



"bssid" is only initialized out of the while loop, in case of two
events with same type: EVENT_CONNECT_RESULT, but one has zero
ether addr, the other is non-zero, the bssid pointer will be
referenced twice, which lead to use-after-free issue.

Change-Id: Ie8a24275f7ec5c2f936ef0a802a42e5f63be9c71
CRs-Fixed: 2254305
Signed-off-by: default avatarZhu Jianmin <jianminz@codeaurora.org>
parent 38bc3d98

net/wireless/util.c

+1 −2
Original line number Diff line number Diff line
@@ -819,7 +819,6 @@ void cfg80211_process_wdev_events(struct wireless_dev *wdev) 
		wdev_lock(wdev);

		switch (ev->type) {

		case EVENT_CONNECT_RESULT:

			if (!is_zero_ether_addr(ev->cr.bssid))

			bssid = ev->cr.bssid;

			__cfg80211_connect_result(

				wdev->netdev, bssid,