Gitweb:     
http://git.kernel.org/git/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=b6b8abe4ddec2cfb3471ea60f965a137cd4d529d
Commit:     b6b8abe4ddec2cfb3471ea60f965a137cd4d529d
Parent:     c3f949618d01d6c40a0267ae8c01695cc2de08e2
Author:     Holger Schurig <[EMAIL PROTECTED]>
AuthorDate: Mon Dec 10 12:19:55 2007 +0100
Committer:  David S. Miller <[EMAIL PROTECTED]>
CommitDate: Mon Jan 28 15:06:34 2008 -0800

    libertas: fix use-after-free error
    
    Previously, the display of subscribed events could be wrong.
    
    Signed-off-by: Holger Schurig <[EMAIL PROTECTED]>
    Signed-off-by: David Woodhouse <[EMAIL PROTECTED]>
    Signed-off-by: John W. Linville <[EMAIL PROTECTED]>
---
 drivers/net/wireless/libertas/debugfs.c |   14 ++++++++------
 1 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/drivers/net/wireless/libertas/debugfs.c 
b/drivers/net/wireless/libertas/debugfs.c
index 745191a..c5130a2 100644
--- a/drivers/net/wireless/libertas/debugfs.c
+++ b/drivers/net/wireless/libertas/debugfs.c
@@ -410,30 +410,32 @@ static ssize_t lbs_threshold_read(
        char *buf = (char *)addr;
        u8 value;
        u8 freq;
+       int events = 0;
 
-       struct cmd_ds_802_11_subscribe_event *events = kzalloc(
+       struct cmd_ds_802_11_subscribe_event *subscribed = kzalloc(
                sizeof(struct cmd_ds_802_11_subscribe_event),
                GFP_KERNEL);
        struct mrvlietypes_thresholds *got;
 
        res = lbs_prepare_and_send_command(priv,
                        CMD_802_11_SUBSCRIBE_EVENT, CMD_ACT_GET,
-                       CMD_OPTION_WAITFORRSP, 0, events);
+                       CMD_OPTION_WAITFORRSP, 0, subscribed);
        if (res) {
-               kfree(events);
+               kfree(subscribed);
                return res;
        }
 
-       got = lbs_tlv_find(tlv_type, events->tlv, sizeof(events->tlv));
+       got = lbs_tlv_find(tlv_type, subscribed->tlv, sizeof(subscribed->tlv));
        if (got) {
                value = got->value;
                freq  = got->freq;
+               events = le16_to_cpu(subscribed->events);
        }
-       kfree(events);
+       kfree(subscribed);
 
        if (got)
                pos += snprintf(buf, len, "%d %d %d\n", value, freq,
-                       !!(le16_to_cpu(events->events) & event_mask));
+                       !!(events & event_mask));
 
        res = simple_read_from_buffer(userbuf, count, ppos, buf, pos);
 
-
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Reply via email to