]> git.baikalelectronics.ru Git - kernel.git/commit
b43: Avoid possible double calls to b43_one_core_detach()
authorJia-Ju Bai <baijiaju1990@gmail.com>
Sat, 4 May 2019 09:10:00 +0000 (17:10 +0800)
committerKalle Valo <kvalo@codeaurora.org>
Tue, 28 May 2019 12:43:34 +0000 (15:43 +0300)
commit80e6073386850b8aaa5e2ff57e5b3018735fb23c
treeb365fc138a6ad3d07f804e3036b68fe8b270930d
parent6644a64cdf3202e180b319189f10719e07436c53
b43: Avoid possible double calls to b43_one_core_detach()

In b43_request_firmware(), when ieee80211_register_hw() fails,
b43_one_core_detach() is called. In b43_bcma_remove() and
b43_ssb_remove(), b43_one_core_detach() is called again. In this case,
null-pointer dereferences and double-free problems can occur when
the driver is removed.

To fix this bug, the call to b43_one_core_detach() in
b43_request_firmware() is deleted.

This bug is found by a runtime fuzzing tool named FIZZER written by us.

Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
drivers/net/wireless/broadcom/b43/main.c