From 6a27224f964d045cc8358f7c23dce3ab401f702d Mon Sep 17 00:00:00 2001 From: Javier Martinez Canillas Date: Tue, 22 Sep 2015 15:24:50 +0200 Subject: [PATCH] staging: wicl1000: fix dereference after free in wilc_wlan_cleanup() The wilc_wlan_cleanup() function iterates over the list of transmission buffers freeing all of them and then iterates over the receive buffers list to free all of them as well. But on the receive loop a pointer to struct txq_entry_t is dereferenced instead of the pointer to a struct rxq_entry_t. This not only causes a dereference to a pointer already freed but also leaks the memory in the struct rxq_entry_t buffer. Also, the buffer is allocated when MEMORY_STATIC is not defined no when MEMORY_DYNAMIC is defined. So use #ifndef MEMORY_STATIC instead as it's done in the rest of the driver to avoid leaking the buffer memory. Fixes: c5c77ba18ea6 ("staging: wilc1000: Add SDIO/SPI 802.11 driver") Signed-off-by: Javier Martinez Canillas Signed-off-by: Greg Kroah-Hartman --- drivers/staging/wilc1000/wilc_wlan.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/staging/wilc1000/wilc_wlan.c b/drivers/staging/wilc1000/wilc_wlan.c index 0a930ecef554..ddb03a82b0f9 100644 --- a/drivers/staging/wilc1000/wilc_wlan.c +++ b/drivers/staging/wilc1000/wilc_wlan.c @@ -1710,8 +1710,8 @@ static void wilc_wlan_cleanup(void) rqe = wilc_wlan_rxq_remove(); if (rqe == NULL) break; -#ifdef MEMORY_DYNAMIC - kfree(tqe->buffer); +#ifndef MEMORY_STATIC + kfree(rqe->buffer); #endif kfree(rqe); } while (1); -- 2.30.2