lkml.org 
[lkml]   [2018]   [Dec]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH] cw1200: Fix concurrency use-after-free bugs in cw1200_hw_scan()
From
Date
Jia-Ju Bai <baijiaju1990@gmail.com> wrote:

> The function cw1200_bss_info_changed() and cw1200_hw_scan() can be
> concurrently executed.
> The two functions both access a possible shared variable "frame.skb".
>
> This shared variable is freed by dev_kfree_skb() in cw1200_upload_beacon(),
> which is called by cw1200_bss_info_changed(). The free operation is
> protected by a mutex lock "priv->conf_mutex" in cw1200_bss_info_changed().
>
> In cw1200_hw_scan(), this shared variable is accessed without the
> protection of the mutex lock "priv->conf_mutex".
> Thus, concurrency use-after-free bugs may occur.
>
> To fix these bugs, the original calls to mutex_lock(&priv->conf_mutex) and
> mutex_unlock(&priv->conf_mutex) are moved to the places, which can
> protect the accesses to the shared variable.
>
> Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>

Patch applied to wireless-drivers-next.git, thanks.

4f68ef64cd7f cw1200: Fix concurrency use-after-free bugs in cw1200_hw_scan()

--
https://patchwork.kernel.org/patch/10730469/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches

\
 
 \ /
  Last update: 2018-12-20 07:50    [W:0.044 / U:0.844 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site