From patchwork Tue Sep 22 13:24:50 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Javier Martinez Canillas X-Patchwork-Id: 7238951 X-Patchwork-Delegate: kvalo@adurom.com Return-Path: X-Original-To: patchwork-linux-wireless@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork2.web.kernel.org (Postfix) with ESMTP id 52311BEEC1 for ; Tue, 22 Sep 2015 13:32:37 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 7451E20519 for ; Tue, 22 Sep 2015 13:32:36 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 90397204A7 for ; Tue, 22 Sep 2015 13:32:35 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1758031AbbIVNcX (ORCPT ); Tue, 22 Sep 2015 09:32:23 -0400 Received: from lists.s-osg.org ([54.187.51.154]:38592 "EHLO lists.s-osg.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S933535AbbIVNZA (ORCPT ); Tue, 22 Sep 2015 09:25:00 -0400 Received: from localhost.localdomain (209.51.23.95.dynamic.jazztel.es [95.23.51.209]) by lists.s-osg.org (Postfix) with ESMTPSA id A72C7462EB; Tue, 22 Sep 2015 06:24:56 -0700 (PDT) From: Javier Martinez Canillas To: linux-kernel@vger.kernel.org Cc: Sudip Mukherjee , Javier Martinez Canillas , devel@driverdev.osuosl.org, linux-wireless@vger.kernel.org, Johnny Kim , Tony Cho , Leo Kim , Glen Lee , Greg Kroah-Hartman , Rachel Kim , Chris Park Subject: [PATCH v2] staging: wicl1000: fix dereference after free in wilc_wlan_cleanup() Date: Tue, 22 Sep 2015 15:24:50 +0200 Message-Id: <1442928290-11484-1-git-send-email-javier@osg.samsung.com> X-Mailer: git-send-email 2.4.3 Sender: linux-wireless-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-wireless@vger.kernel.org X-Spam-Status: No, score=-6.9 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP The wilc_wlan_cleanup() function iterates over the list of transmission buffers freeing all of them and then iterates over the receive buffers list to free all of them as well. But on the receive loop a pointer to struct txq_entry_t is dereferenced instead of the pointer to a struct rxq_entry_t. This not only causes a dereference to a pointer already freed but also leaks the memory in the struct rxq_entry_t buffer. Also, the buffer is allocated when MEMORY_STATIC is not defined no when MEMORY_DYNAMIC is defined. So use #ifndef MEMORY_STATIC instead as it's done in the rest of the driver to avoid leaking the buffer memory. Fixes: c5c77ba18ea6 ("staging: wilc1000: Add SDIO/SPI 802.11 driver") Signed-off-by: Javier Martinez Canillas --- Changes in v2: - Change also the #ifdef MEMORY_DYNAMIC to #ifndef MEMORY_STATIC since buffer is allocated when MEMORY_STATIC isn't defined. Suggested by Sudip Mukherjee. drivers/staging/wilc1000/wilc_wlan.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/staging/wilc1000/wilc_wlan.c b/drivers/staging/wilc1000/wilc_wlan.c index 4c25179c2fec..fc9028d59dcd 100644 --- a/drivers/staging/wilc1000/wilc_wlan.c +++ b/drivers/staging/wilc1000/wilc_wlan.c @@ -1745,8 +1745,8 @@ static void wilc_wlan_cleanup(void) rqe = wilc_wlan_rxq_remove(); if (rqe == NULL) break; -#ifdef MEMORY_DYNAMIC - kfree(tqe->buffer); +#ifndef MEMORY_STATIC + kfree(rqe->buffer); #endif kfree(rqe); } while (1);