diff options
| author | Rafał Miłecki <rafal@milecki.pl> | 2019-01-07 17:11:23 +0100 |
|---|---|---|
| committer | Rafał Miłecki <rafal@milecki.pl> | 2019-01-07 17:13:59 +0100 |
| commit | 529c95cc15dc9fcc7709400cc921f2a3c03cd263 (patch) | |
| tree | 1d095a964796c83a4e406c04ac225763ad45e31e /package/kernel/mac80211/files | |
| parent | 630d8b87a570b87ec3a0a2f950e87f674d381800 (diff) | |
| download | upstream-529c95cc15dc9fcc7709400cc921f2a3c03cd263.tar.gz upstream-529c95cc15dc9fcc7709400cc921f2a3c03cd263.tar.bz2 upstream-529c95cc15dc9fcc7709400cc921f2a3c03cd263.zip | |
mac80211: brcmfmac: fix use-after-free & possible NULL pointer dereference
1) Using fwctx variable after brcmf_fw_request_done() was executed meant
accessing freed memory.
2) Using fwctx->completion for the wait_for_completion_timeout() call
could reuslt in NULL pointer dereference on fw loading error or if
brcmf_fw_request_done() was executed quickly enough.
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Diffstat (limited to 'package/kernel/mac80211/files')
0 files changed, 0 insertions, 0 deletions