]> git.baikalelectronics.ru Git - kernel.git/commit
cw1200: Revert unnecessary patches that fix unreal use-after-free bugs
authorHang Zhang <zh.nvgt@gmail.com>
Fri, 21 May 2021 22:32:38 +0000 (15:32 -0700)
committerKalle Valo <kvalo@codeaurora.org>
Tue, 15 Jun 2021 13:41:22 +0000 (16:41 +0300)
commit3ff78e39e6522f107787b4d7abb3377ad0e1bac5
tree6c926e5e62b03f1225918ca9ebd635bf6f90be02
parent6b83bfa6b4ae1f1d58521f347442ac6dedf13cb5
cw1200: Revert unnecessary patches that fix unreal use-after-free bugs

A previous commit 08b4f26c19f6 ("cw1200: Fix concurrency
use-after-free bugs in cw1200_hw_scan()") tried to fix a seemingly
use-after-free bug between cw1200_bss_info_changed() and
cw1200_hw_scan(), where the former frees a sk_buff pointed
to by frame.skb, and the latter accesses the sk_buff
pointed to by frame.skb. However, this issue should be a
false alarm because:

(1) "frame.skb" is not a shared variable between the above
two functions, because "frame" is a local function variable,
each of the two functions has its own local "frame" - they
just happen to have the same variable name.

(2) the sk_buff(s) pointed to by these two "frame.skb" are
also two different object instances, they are individually
allocated by different dev_alloc_skb() within the two above
functions. To free one object instance will not invalidate
the access of another different one.

Based on these facts, the previous commit should be unnecessary.
Moreover, it also introduced a missing unlock which was
addressed in a subsequent commit 29ed91a350dd ("cw1200: fix missing
unlock on error in cw1200_hw_scan()"). Now that the
original use-after-free is unreal, these two commits should
be reverted. This patch performs the reversion.

Fixes: 08b4f26c19f6 ("cw1200: Fix concurrency use-after-free bugs in cw1200_hw_scan()")
Fixes: 29ed91a350dd ("cw1200: fix missing unlock on error in cw1200_hw_scan()")
Signed-off-by: Hang Zhang <zh.nvgt@gmail.com>
Acked-by: Jia-Ju Bai <baijiaju1990@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20210521223238.25020-1-zh.nvgt@gmail.com
drivers/net/wireless/st/cw1200/scan.c