diff mbox series

[Xenial,SRU,CVE-2018-21008] rsi: add fix for crash during assertions

Message ID 20190926185616.13076-2-connor.kuehl@canonical.com
State New
Headers show
Series [Xenial,SRU,CVE-2018-21008] rsi: add fix for crash during assertions | expand

Commit Message

Connor Kuehl Sept. 26, 2019, 6:56 p.m. UTC 
From: Sanjay Konduri <sanjay.konduri@redpinesignals.com>

CVE-2018-21008

Observed crash in some scenarios when assertion has occurred,
this is because hw structure is freed and is tried to get
accessed in some functions where null check is already
present. So, avoided the crash by making the hw to NULL after
freeing.

Signed-off-by: Sanjay Konduri <sanjay.konduri@redpinesignals.com>
Signed-off-by: Sushant Kumar Mishra <sushant.mishra@redpinesignals.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
(backported from commit abd39c6ded9db53aa44c2540092bdd5fb6590fa8)
[ Connor Kuehl: offset adjustment ]
Signed-off-by: Connor Kuehl <connor.kuehl@canonical.com>
---
 drivers/net/wireless/rsi/rsi_91x_mac80211.c | 1 +
 1 file changed, 1 insertion(+)
diff mbox series

Patch

diff --git a/drivers/net/wireless/rsi/rsi_91x_mac80211.c b/drivers/net/wireless/rsi/rsi_91x_mac80211.c
index 4df992de7d07..2f40506a5821 100644
--- a/drivers/net/wireless/rsi/rsi_91x_mac80211.c
+++ b/drivers/net/wireless/rsi/rsi_91x_mac80211.c
@@ -199,6 +199,7 @@  void rsi_mac80211_detach(struct rsi_hw *adapter)
 		ieee80211_stop_queues(hw);
 		ieee80211_unregister_hw(hw);
 		ieee80211_free_hw(hw);
+		adapter->hw = NULL;
 	}
 
 	rsi_remove_dbgfs(adapter);