2008-01-23 11:16:41

by Michael Büsch

Subject: [PATCH] b43legacy: Fix rfkill allocation leakage in error paths

We must kill rfkill in any error paths that trigger after rfkill init.

Signed-off-by: Michael Buesch <[email protected]>

---

John, please try to push this for 2.6.24. Seems quite important,
as it leaks resources and might crash the kernel.


Index: wireless-2.6/drivers/net/wireless/b43legacy/main.c
===================================================================
--- wireless-2.6.orig/drivers/net/wireless/b43legacy/main.c 2008-01-16 23:28:50.000000000 +0100
+++ wireless-2.6/drivers/net/wireless/b43legacy/main.c 2008-01-23 12:04:41.000000000 +0100
@@ -3218,38 +3218,45 @@ static void b43legacy_op_remove_interfac
static int b43legacy_op_start(struct ieee80211_hw *hw)
{
struct b43legacy_wl *wl = hw_to_b43legacy_wl(hw);
struct b43legacy_wldev *dev = wl->current_dev;
int did_init = 0;
int err = 0;
+ bool do_rfkill_exit = 0;

/* First register RFkill.
* LEDs that are registered later depend on it. */
b43legacy_rfkill_init(dev);

mutex_lock(&wl->mutex);

if (b43legacy_status(dev) < B43legacy_STAT_INITIALIZED) {
err = b43legacy_wireless_core_init(dev);
- if (err)
+ if (err) {
+ do_rfkill_exit = 1;
goto out_mutex_unlock;
+ }
did_init = 1;
}

if (b43legacy_status(dev) < B43legacy_STAT_STARTED) {
err = b43legacy_wireless_core_start(dev);
if (err) {
if (did_init)
b43legacy_wireless_core_exit(dev);
+ do_rfkill_exit = 1;
goto out_mutex_unlock;
}
}

out_mutex_unlock:
mutex_unlock(&wl->mutex);

+ if (do_rfkill_exit)
+ b43legacy_rfkill_exit(dev);
+
return err;
}

static void b43legacy_op_stop(struct ieee80211_hw *hw)
{
struct b43legacy_wl *wl = hw_to_b43legacy_wl(hw);

2008-01-23 13:05:29

by Stefano Brivio

Subject: Re: [PATCH] b43legacy: Fix rfkill allocation leakage in error paths

On Wed, 23 Jan 2008 12:15:38 +0100
Michael Buesch <[email protected]> wrote:

> We must kill rfkill in any error paths that trigger after rfkill init.
>
> Signed-off-by: Michael Buesch <[email protected]>

Acked-by: Stefano Brivio <[email protected]>


--
Ciao
Stefano