diff options
| author | Andreas Wendleder <gonsolo@gmail.com> | 2026-10-13 02:01:24 +0200 |
|---|---|---|
| committer | Johannes Berg <johannes.berg@intel.com> | 2026-10-13 13:59:38 +0200 |
| commit | c6c8bc355657115664131b38c53c5ddf7d93b072 (patch) | |
| tree | 2703eabd3e1b096ee13b7c278fa442d5e22e4283 | |
| parent | 48002331da85c7c962cfbc09c8bd84d219a6fe1c (diff) | |
wifi: b43: fix use-after-free in b43_bcma_remove()
b43_one_core_detach() frees the struct b43_wldev it is given the bus
device of. b43_bcma_remove() then reads wldev->dev again to free the bus
device, which is a read of freed memory.
b43_ssb_remove() does not have the problem: it takes a copy of wldev->dev
at the start. Do the same here.
Fixes: 96838d61102a ("b43: Fix memory leaks in b43_bus_dev_ssb_init and b43_bus_dev_bcma_init")
Cc: stable@vger.kernel.org
Signed-off-by: Andreas Wendleder <gonsolo@gmail.com>
Link: https://patch.msgid.link/20261013000124.48605-1-gonsolo@gmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| -rw-r--r-- | drivers/net/wireless/broadcom/b43/main.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/drivers/net/wireless/broadcom/b43/main.c b/drivers/net/wireless/broadcom/b43/main.c index 817448e58e7f..3825b6ad9f4f 100644 --- a/drivers/net/wireless/broadcom/b43/main.c +++ b/drivers/net/wireless/broadcom/b43/main.c @@ -5677,6 +5677,7 @@ static void b43_bcma_remove(struct bcma_device *core) { struct b43_wldev *wldev = bcma_get_drvdata(core); struct b43_wl *wl = wldev->wl; + struct b43_bus_dev *dev = wldev->dev; /* We must cancel any work here before unregistering from ieee80211, * as the ieee80211 unreg will destroy the workqueue. */ @@ -5691,14 +5692,14 @@ static void b43_bcma_remove(struct bcma_device *core) ieee80211_unregister_hw(wl->hw); } - b43_one_core_detach(wldev->dev); + b43_one_core_detach(dev); /* Unregister HW RNG driver */ b43_rng_exit(wl); b43_leds_unregister(wl); ieee80211_free_hw(wl->hw); - kfree(wldev->dev); + kfree(dev); } static struct bcma_driver b43_bcma_driver = { |