Skip to content
  • Hang Zhang's avatar
    3f60f468
    cw1200: Revert unnecessary patches that fix unreal use-after-free bugs · 3f60f468
    Hang Zhang authored
    
    
    A previous commit 4f68ef64 ("cw1200: Fix concurrency
    use-after-free bugs in cw1200_hw_scan()") tried to fix a seemingly
    use-after-free bug between cw1200_bss_info_changed() and
    cw1200_hw_scan(), where the former frees a sk_buff pointed
    to by frame.skb, and the latter accesses the sk_buff
    pointed to by frame.skb. However, this issue should be a
    false alarm because:
    
    (1) "frame.skb" is not a shared variable between the above
    two functions, because "frame" is a local function variable,
    each of the two functions has its own local "frame" - they
    just happen to have the same variable name.
    
    (2) the sk_buff(s) pointed to by these two "frame.skb" are
    also two different object instances, they are individually
    allocated by different dev_alloc_skb() within the two above
    functions. To free one object instance will not invalidate
    the access of another different one.
    
    Based on these facts, the previous commit should be unnecessary.
    Moreover, it also introduced a missing unlock which was
    addressed in a subsequent commit 51c8d241 ("cw1200: fix missing
    unlock on error in cw1200_hw_scan()"). Now that the
    original use-after-free is unreal, these two commits should
    be reverted. This patch performs the reversion.
    
    Fixes: 4f68ef64 ("cw1200: Fix concurrency use-after-free bugs in cw1200_hw_scan()")
    Fixes: 51c8d241 ("cw1200: fix missing unlock on error in cw1200_hw_scan()")
    Signed-off-by: default avatarHang Zhang <zh.nvgt@gmail.com>
    Acked-by: default avatarJia-Ju Bai <baijiaju1990@gmail.com>
    Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
    Link: https://lore.kernel.org/r/20210521223238.25020-1-zh.nvgt@gmail.com
    3f60f468
    cw1200: Revert unnecessary patches that fix unreal use-after-free bugs
    Hang Zhang authored
    
    
    A previous commit 4f68ef64 ("cw1200: Fix concurrency
    use-after-free bugs in cw1200_hw_scan()") tried to fix a seemingly
    use-after-free bug between cw1200_bss_info_changed() and
    cw1200_hw_scan(), where the former frees a sk_buff pointed
    to by frame.skb, and the latter accesses the sk_buff
    pointed to by frame.skb. However, this issue should be a
    false alarm because:
    
    (1) "frame.skb" is not a shared variable between the above
    two functions, because "frame" is a local function variable,
    each of the two functions has its own local "frame" - they
    just happen to have the same variable name.
    
    (2) the sk_buff(s) pointed to by these two "frame.skb" are
    also two different object instances, they are individually
    allocated by different dev_alloc_skb() within the two above
    functions. To free one object instance will not invalidate
    the access of another different one.
    
    Based on these facts, the previous commit should be unnecessary.
    Moreover, it also introduced a missing unlock which was
    addressed in a subsequent commit 51c8d241 ("cw1200: fix missing
    unlock on error in cw1200_hw_scan()"). Now that the
    original use-after-free is unreal, these two commits should
    be reverted. This patch performs the reversion.
    
    Fixes: 4f68ef64 ("cw1200: Fix concurrency use-after-free bugs in cw1200_hw_scan()")
    Fixes: 51c8d241 ("cw1200: fix missing unlock on error in cw1200_hw_scan()")
    Signed-off-by: default avatarHang Zhang <zh.nvgt@gmail.com>
    Acked-by: default avatarJia-Ju Bai <baijiaju1990@gmail.com>
    Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
    Link: https://lore.kernel.org/r/20210521223238.25020-1-zh.nvgt@gmail.com
Loading