lkml.org 
[lkml]   [2013]   [May]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[ 008/136 ] iwlwifi: fix freeing uninitialized pointer
    3.6.11.4 stable review patch.
    If anyone has any objections, please let me know.

    ------------------

    From: Stanislaw Gruszka <sgruszka@redhat.com>

    [ Upstream commit 3309ccf7fcebceef540ebe90c65d2f94d745a45b ]

    If on iwl_dump_nic_event_log() error occurs before that function
    initialize buf, we process uninitiated pointer in
    iwl_dbgfs_log_event_read() and can hit "BUG at mm/slub.c:3409"

    Resolves:
    https://bugzilla.redhat.com/show_bug.cgi?id=951241

    Cc: stable@vger.kernel.org
    Reported-by: ian.odette@eprize.com
    Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
    Reviewed-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
    ---
    drivers/net/wireless/iwlwifi/dvm/debugfs.c | 16 ++++++++--------
    1 file changed, 8 insertions(+), 8 deletions(-)

    diff --git a/drivers/net/wireless/iwlwifi/dvm/debugfs.c b/drivers/net/wireless/iwlwifi/dvm/debugfs.c
    index a47b306..b3f10cb 100644
    --- a/drivers/net/wireless/iwlwifi/dvm/debugfs.c
    +++ b/drivers/net/wireless/iwlwifi/dvm/debugfs.c
    @@ -2237,15 +2237,15 @@ static ssize_t iwl_dbgfs_log_event_read(struct file *file,
    size_t count, loff_t *ppos)
    {
    struct iwl_priv *priv = file->private_data;
    - char *buf;
    - int pos = 0;
    - ssize_t ret = -ENOMEM;
    + char *buf = NULL;
    + ssize_t ret;

    - ret = pos = iwl_dump_nic_event_log(priv, true, &buf, true);
    - if (buf) {
    - ret = simple_read_from_buffer(user_buf, count, ppos, buf, pos);
    - kfree(buf);
    - }
    + ret = iwl_dump_nic_event_log(priv, true, &buf, true);
    + if (ret < 0)
    + goto err;
    + ret = simple_read_from_buffer(user_buf, count, ppos, buf, ret);
    +err:
    + kfree(buf);
    return ret;
    }

    --
    1.7.10.4



    \
     
     \ /
      Last update: 2013-05-18 05:21    [W:4.053 / U:0.016 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site