linux/drivers/net/wireless/p54
Christian Lamparter e2fe154e91 p54usb: fix nasty use after free
In theory, the firmware acks the received a data frame, before signaling the driver to free it again.
However Artur Skawina <art.08.09@gmail.com> has shown that it can happen in reverse order as well.
This is very bad and could lead to memory corruptions, oopses and panics.

Thanks to Artur Skawina <art.08.09@gmail.com> for reporting and debugging this issue.

Signed-off-by: Christian Lamparter <chunkeey@web.de>
Tested-by: Artur Skawina <art.08.09@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-01-22 13:55:02 -05:00
..
Kconfig
Makefile
net2280.h
p54.h p54: remove free_on_tx parameter 2008-12-19 15:23:19 -05:00
p54common.c p54: more cryptographic accelerator fixes 2009-01-22 13:55:02 -05:00
p54common.h p54: remove free_on_tx parameter 2008-12-19 15:23:19 -05:00
p54pci.c p54: remove free_on_tx parameter 2008-12-19 15:23:19 -05:00
p54pci.h p54pci: cache firmware for suspend/resume 2008-11-25 16:41:38 -05:00
p54usb.c p54usb: fix nasty use after free 2009-01-22 13:55:02 -05:00
p54usb.h p54usb: rewriting rx/tx routines to make use of usb_anchor's facilities 2008-12-12 14:01:39 -05:00