[Xenial][SRU][CVE-2018-21008][PATCH] rsi: add fix for crash during assertions

Connor Kuehl connor.kuehl at canonical.com
Thu Sep 26 18:56:15 UTC 2019


From: Sanjay Konduri <sanjay.konduri at redpinesignals.com>

CVE-2018-21008

Observed crash in some scenarios when assertion has occurred,
this is because hw structure is freed and is tried to get
accessed in some functions where null check is already
present. So, avoided the crash by making the hw to NULL after
freeing.

Signed-off-by: Sanjay Konduri <sanjay.konduri at redpinesignals.com>
Signed-off-by: Sushant Kumar Mishra <sushant.mishra at redpinesignals.com>
Signed-off-by: Kalle Valo <kvalo at codeaurora.org>
(backported from commit abd39c6ded9db53aa44c2540092bdd5fb6590fa8)
[ Connor Kuehl: offset adjustment ]
Signed-off-by: Connor Kuehl <connor.kuehl at canonical.com>
---
 drivers/net/wireless/rsi/rsi_91x_mac80211.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/wireless/rsi/rsi_91x_mac80211.c b/drivers/net/wireless/rsi/rsi_91x_mac80211.c
index 4df992de7d07..2f40506a5821 100644
--- a/drivers/net/wireless/rsi/rsi_91x_mac80211.c
+++ b/drivers/net/wireless/rsi/rsi_91x_mac80211.c
@@ -199,6 +199,7 @@ void rsi_mac80211_detach(struct rsi_hw *adapter)
 		ieee80211_stop_queues(hw);
 		ieee80211_unregister_hw(hw);
 		ieee80211_free_hw(hw);
+		adapter->hw = NULL;
 	}
 
 	rsi_remove_dbgfs(adapter);
-- 
2.17.1




More information about the kernel-team mailing list