Commit 9d4eed68 authored by Rafał Miłecki's avatar Rafał Miłecki
Browse files

mac80211: brcmfmac: fix use-after-free & possible NULL pointer dereference



1) Using fwctx variable after brcmf_fw_request_done() was executed meant
   accessing freed memory.
2) Using fwctx->completion for the wait_for_completion_timeout() call
   could reuslt in NULL pointer dereference on fw loading error or if
   brcmf_fw_request_done() was executed quickly enough.
Signed-off-by: default avatarRafał Miłecki <rafal@milecki.pl>
(cherry picked from commit 529c95cc)
parent 834bd864
......@@ -88,9 +88,9 @@ Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
GFP_KERNEL, fwctx,
brcmf_fw_request_code_done);
+ if (!err)
+ wait_for_completion_timeout(fwctx->completion,
+ wait_for_completion_timeout(&completion,
+ msecs_to_jiffies(5000));
+ fwctx->completion = NULL;
+
+ return err;
}
......
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment