linux/drivers/net/wireless/broadcom
Arend Van Spriel d77facb884 brcmfmac: use local iftype avoiding use-after-free of virtual interface
A use-after-free was found using KASAN. In brcmf_p2p_del_if() the virtual
interface is removed using call to brcmf_remove_interface(). After that
the virtual interface instance has been freed and should not be referenced.
Solve this by storing the nl80211 iftype in local variable, which is used
in a couple of places anyway.

Cc: stable@vger.kernel.org # 4.10.x, 4.9.x
Reported-by: Daniel J Blueman <daniel@quora.org>
Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
Reviewed-by: Franky Lin <franky.lin@broadcom.com>
Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
2017-03-30 19:43:51 +03:00
..
b43 wireless: deprecate WDS and disable by default 2016-10-27 09:08:43 +02:00
b43legacy sched/headers: Prepare to move signal wakeup & sigpending methods from <linux/sched.h> into <linux/sched/signal.h> 2017-03-02 08:42:32 +01:00
brcm80211 brcmfmac: use local iftype avoiding use-after-free of virtual interface 2017-03-30 19:43:51 +03:00
Kconfig brcm80211: move under broadcom vendor directory 2015-11-18 11:24:22 +02:00
Makefile brcm80211: move under broadcom vendor directory 2015-11-18 11:24:22 +02:00