diff options
| author | Holger Schurig <hs4233@mail.mn-solutions.de> | 2007-12-10 11:19:55 (GMT) |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2008-01-28 23:06:34 (GMT) |
| commit | b6b8abe4ddec2cfb3471ea60f965a137cd4d529d (patch) | |
| tree | bd666f4ecea2477fb7734abfb0e5a150549694e2 /drivers | |
| parent | c3f949618d01d6c40a0267ae8c01695cc2de08e2 (diff) | |
| download | linux-b6b8abe4ddec2cfb3471ea60f965a137cd4d529d.tar.xz | |
libertas: fix use-after-free error
Previously, the display of subscribed events could be wrong.
Signed-off-by: Holger Schurig <hs4233@mail.mn-solutions.de>
Signed-off-by: David Woodhouse <dwmw2@infradead.org>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/net/wireless/libertas/debugfs.c | 14 |
1 files changed, 8 insertions, 6 deletions
diff --git a/drivers/net/wireless/libertas/debugfs.c b/drivers/net/wireless/libertas/debugfs.c index 745191a..c5130a2 100644 --- a/drivers/net/wireless/libertas/debugfs.c +++ b/drivers/net/wireless/libertas/debugfs.c @@ -410,30 +410,32 @@ static ssize_t lbs_threshold_read( char *buf = (char *)addr; u8 value; u8 freq; + int events = 0; - struct cmd_ds_802_11_subscribe_event *events = kzalloc( + struct cmd_ds_802_11_subscribe_event *subscribed = kzalloc( sizeof(struct cmd_ds_802_11_subscribe_event), GFP_KERNEL); struct mrvlietypes_thresholds *got; res = lbs_prepare_and_send_command(priv, CMD_802_11_SUBSCRIBE_EVENT, CMD_ACT_GET, - CMD_OPTION_WAITFORRSP, 0, events); + CMD_OPTION_WAITFORRSP, 0, subscribed); if (res) { - kfree(events); + kfree(subscribed); return res; } - got = lbs_tlv_find(tlv_type, events->tlv, sizeof(events->tlv)); + got = lbs_tlv_find(tlv_type, subscribed->tlv, sizeof(subscribed->tlv)); if (got) { value = got->value; freq = got->freq; + events = le16_to_cpu(subscribed->events); } - kfree(events); + kfree(subscribed); if (got) pos += snprintf(buf, len, "%d %d %d\n", value, freq, - !!(le16_to_cpu(events->events) & event_mask)); + !!(events & event_mask)); res = simple_read_from_buffer(userbuf, count, ppos, buf, pos); |