[PATCH 1/2] libertas: don't exit from lbs_ibss_join_existing() with RCU read lock held
From: Nicolai Stange <hidden>
Date: 2020-01-14 10:39:53
Also in:
linux-wireless, lkml
Subsystem:
marvell libertas wireless driver, the rest · Maintainer:
Linus Torvalds
Possibly related (same subject, not in this thread)
- 2020-01-15 · Re: [PATCH 1/2] libertas: don't exit from lbs_ibss_join_existing() with RCU read lock held · Nicolai Stange <hidden>
- 2020-01-14 · Re: [PATCH 1/2] libertas: don't exit from lbs_ibss_join_existing() with RCU read lock held · Kalle Valo <hidden>
Commit e5e884b42639 ("libertas: Fix two buffer overflows at parsing bss
descriptor") introduced a bounds check on the number of supplied rates to
lbs_ibss_join_existing().
Unfortunately, it introduced a return path from within a RCU read side
critical section without a corresponding rcu_read_unlock(). Fix this.
Fixes: e5e884b42639 ("libertas: Fix two buffer overflows at parsing bss
descriptor")
Signed-off-by: Nicolai Stange <redacted>
---
drivers/net/wireless/marvell/libertas/cfg.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/wireless/marvell/libertas/cfg.c b/drivers/net/wireless/marvell/libertas/cfg.c
index c9401c121a14..68985d766349 100644
--- a/drivers/net/wireless/marvell/libertas/cfg.c
+++ b/drivers/net/wireless/marvell/libertas/cfg.c@@ -1785,6 +1785,7 @@ static int lbs_ibss_join_existing(struct lbs_private *priv, rates_max = rates_eid[1]; if (rates_max > MAX_RATES) { lbs_deb_join("invalid rates"); + rcu_read_unlock(); goto out; } rates = cmd.bss.rates;
--
2.16.4