diff options
| author | Arend Van Spriel <arend.vanspriel@broadcom.com> | 2017-03-28 09:11:30 +0100 |
|---|---|---|
| committer | Kalle Valo <kvalo@codeaurora.org> | 2017-03-30 19:43:51 +0300 |
| commit | d77facb88448cdeaaa3adba5b9704a48ac2ac8d6 (patch) | |
| tree | 52a9ee41042d543f0dd0a420f8d4912ea6e41863 /net | |
| parent | 893dc68f1b18451e6d550b1884fc6be76e1bb90c (diff) | |
| download | linux-stable-d77facb88448cdeaaa3adba5b9704a48ac2ac8d6.tar.gz linux-stable-d77facb88448cdeaaa3adba5b9704a48ac2ac8d6.tar.bz2 linux-stable-d77facb88448cdeaaa3adba5b9704a48ac2ac8d6.zip | |
brcmfmac: use local iftype avoiding use-after-free of virtual interface
A use-after-free was found using KASAN. In brcmf_p2p_del_if() the virtual
interface is removed using call to brcmf_remove_interface(). After that
the virtual interface instance has been freed and should not be referenced.
Solve this by storing the nl80211 iftype in local variable, which is used
in a couple of places anyway.
Cc: stable@vger.kernel.org # 4.10.x, 4.9.x
Reported-by: Daniel J Blueman <daniel@quora.org>
Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
Reviewed-by: Franky Lin <franky.lin@broadcom.com>
Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Diffstat (limited to 'net')
0 files changed, 0 insertions, 0 deletions