From patchwork Tue Sep 22 10:24:50 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Javier Martinez Canillas X-Patchwork-Id: 7237961 X-Patchwork-Delegate: kvalo@adurom.com Return-Path: X-Original-To: patchwork-linux-wireless@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork2.web.kernel.org (Postfix) with ESMTP id B7EE4BEEC1 for ; Tue, 22 Sep 2015 10:25:44 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id E282220709 for ; Tue, 22 Sep 2015 10:25:43 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 0DBF42070A for ; Tue, 22 Sep 2015 10:25:43 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1757755AbbIVKZB (ORCPT ); Tue, 22 Sep 2015 06:25:01 -0400 Received: from lists.s-osg.org ([54.187.51.154]:38553 "EHLO lists.s-osg.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754111AbbIVKZA (ORCPT ); Tue, 22 Sep 2015 06:25:00 -0400 Received: from localhost.localdomain (209.51.23.95.dynamic.jazztel.es [95.23.51.209]) by lists.s-osg.org (Postfix) with ESMTPSA id 85DF74632B; Tue, 22 Sep 2015 03:24:56 -0700 (PDT) From: Javier Martinez Canillas To: linux-kernel@vger.kernel.org Cc: Javier Martinez Canillas , devel@driverdev.osuosl.org, linux-wireless@vger.kernel.org, Johnny Kim , Tony Cho , Leo Kim , Glen Lee , Greg Kroah-Hartman , Rachel Kim , Chris Park Subject: [PATCH] staging: wicl1000: fix dereference after free in wilc_wlan_cleanup() Date: Tue, 22 Sep 2015 12:24:50 +0200 Message-Id: <1442917490-26574-1-git-send-email-javier@osg.samsung.com> X-Mailer: git-send-email 2.4.3 Sender: linux-wireless-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org X-Spam-Status: No, score=-6.9 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP The wilc_wlan_cleanup() function iterates over the list of transmission buffers freeing all of them and then iterates over the receive buffers list to free all of them as well. But on the receive loop a pointer to struct txq_entry_t is dereferenced instead of the pointer to a struct rxq_entry_t. This not only causes a dereference to a pointer already freed but also leaks the memory in the struct rxq_entry_t buffer. Fixes: c5c77ba18ea6 ("staging: wilc1000: Add SDIO/SPI 802.11 driver") Signed-off-by: Javier Martinez Canillas --- drivers/staging/wilc1000/wilc_wlan.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/staging/wilc1000/wilc_wlan.c b/drivers/staging/wilc1000/wilc_wlan.c index 4c25179c2fec..c40f143b00b7 100644 --- a/drivers/staging/wilc1000/wilc_wlan.c +++ b/drivers/staging/wilc1000/wilc_wlan.c @@ -1746,7 +1746,7 @@ static void wilc_wlan_cleanup(void) if (rqe == NULL) break; #ifdef MEMORY_DYNAMIC - kfree(tqe->buffer); + kfree(rqe->buffer); #endif kfree(rqe); } while (1);