| commit | e2fe154e918276e900067a9d1d3a6a963faee041 | |
| author | Christian Lamparter <chunkeey@web.de> | |
| Mon, 19 Jan 2009 23:27:57 +0000 (20 00:27 +0100) | ||
| committer | John W. Linville <linville@tuxdriver.com> | |
| Thu, 22 Jan 2009 18:55:02 +0000 (22 13:55 -0500) | ||
| tree | 22936f2b3784c4d89c4f1e2263b528167f42e683 | treesnapshot (tar.gz zip) |
| parent | 12da401e0d616f738c8b8a368d1f63f365cc78e4 | commitdiff |
p54usb: fix nasty use after free
In theory, the firmware acks the received a data frame, before signaling the driver to free it again.
However Artur Skawina <art.08.09@gmail.com> has shown that it can happen in reverse order as well.
This is very bad and could lead to memory corruptions, oopses and panics.
Thanks to Artur Skawina <art.08.09@gmail.com> for reporting and debugging this issue.
Signed-off-by: Christian Lamparter <chunkeey@web.de>
Tested-by: Artur Skawina <art.08.09@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
In theory, the firmware acks the received a data frame, before signaling the driver to free it again.
However Artur Skawina <art.08.09@gmail.com> has shown that it can happen in reverse order as well.
This is very bad and could lead to memory corruptions, oopses and panics.
Thanks to Artur Skawina <art.08.09@gmail.com> for reporting and debugging this issue.
Signed-off-by: Christian Lamparter <chunkeey@web.de>
Tested-by: Artur Skawina <art.08.09@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
| drivers/net/wireless/p54/p54usb.c | diffblobblamehistory |