diff mbox

[1/6] mwifiex: Fix an issue spotted by KASAN

Message ID 1466083346-18607-1-git-send-email-akarwar@marvell.com (mailing list archive)
State Accepted
Commit 4699fc3f2dcbcce27d499343c7b85b172b17ee76
Delegated to: Kalle Valo
Headers show

Commit Message

Amitkumar Karwar June 16, 2016, 1:22 p.m. UTC 
From: Ganapathi Bhat <gbhat@marvell.com>

When an association command is sent to firmware but the process is
killed before the command response arrives, driver will try to
access bss_desc which is already freed. This issue is fixed by
checking return value of bss_start.

Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
---
 drivers/net/wireless/marvell/mwifiex/join.c      | 12 ++++++++++++
 drivers/net/wireless/marvell/mwifiex/sta_ioctl.c |  4 ++++
 2 files changed, 16 insertions(+)

Comments

Kalle Valo June 29, 2016, 3:54 p.m. UTC | #1 
Amitkumar Karwar <akarwar@marvell.com> wrote:
> From: Ganapathi Bhat <gbhat@marvell.com>
> 
> When an association command is sent to firmware but the process is
> killed before the command response arrives, driver will try to
> access bss_desc which is already freed. This issue is fixed by
> checking return value of bss_start.
> 
> Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>

Thanks, 6 patches applied to wireless-drivers-next.git:

4699fc3f2dcb mwifiex: Fix an issue spotted by KASAN
a9c790ba23eb mwifiex: factor out mwifiex_cancel_scan
dec277f781ce mwifiex: cancel pending scan during disconnect
437322ea2a36 mwifiex: fix system hang problem after resume
568fb26ec8be mwifiex: fix AP unable to start in VHT40 problem
7311ea850079 mwifiex: fix AP start problem for newly added interface
diff mbox

Patch

diff --git a/drivers/net/wireless/marvell/mwifiex/join.c b/drivers/net/wireless/marvell/mwifiex/join.c
index a4b773d..1c7b006 100644
--- a/drivers/net/wireless/marvell/mwifiex/join.c
+++ b/drivers/net/wireless/marvell/mwifiex/join.c
@@ -647,6 +647,12 @@  int mwifiex_ret_802_11_associate(struct mwifiex_private *priv,
 	const u8 *ie_ptr;
 	struct ieee80211_ht_operation *assoc_resp_ht_oper;
 
+	if (!priv->attempted_bss_desc) {
+		mwifiex_dbg(priv->adapter, ERROR,
+			    "ASSOC_RESP: failed, association terminated by host\n");
+		goto done;
+	}
+
 	assoc_rsp = (struct ieee_types_assoc_rsp *) &resp->params;
 
 	cap_info = le16_to_cpu(assoc_rsp->cap_info_bitmap);
@@ -1270,6 +1276,12 @@  int mwifiex_ret_802_11_ad_hoc(struct mwifiex_private *priv,
 	u16 cmd = le16_to_cpu(resp->command);
 	u8 result;
 
+	if (!priv->attempted_bss_desc) {
+		mwifiex_dbg(priv->adapter, ERROR,
+			    "ADHOC_RESP: failed, association terminated by host\n");
+		goto done;
+	}
+
 	if (cmd == HostCmd_CMD_802_11_AD_HOC_START)
 		result = start_result->result;
 	else
diff --git a/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c b/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c
index 8e08626..2ba5397 100644
--- a/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c
+++ b/drivers/net/wireless/marvell/mwifiex/sta_ioctl.c
@@ -426,6 +426,10 @@  done:
 	if (bss_desc)
 		kfree(bss_desc->beacon_buf);
 	kfree(bss_desc);
+
+	if (ret < 0)
+		priv->attempted_bss_desc = NULL;
+
 	return ret;
 }