kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-10 20:48:12 +00:00
Code Issues Releases Packages Activity
No description
1,314,436 commits 117 branches 5,827 tags 6.3 GiB
  • C 96.8%
  • Assembly 0.9%
  • Rust 0.7%
  • Shell 0.6%
  • Python 0.5%
  • Other 0.3%
Find a file
Marcel Hamer fbbfef2a5b wifi: brcmfmac: fix NULL pointer dereference in brcmf_txfinalize() 
commit 68abd0c4eb upstream.

On removal of the device or unloading of the kernel module a potential NULL
pointer dereference occurs.

The following sequence deletes the interface:

  brcmf_detach()
    brcmf_remove_interface()
      brcmf_del_if()

Inside the brcmf_del_if() function the drvr->if2bss[ifidx] is updated to
BRCMF_BSSIDX_INVALID (-1) if the bsscfgidx matches.

After brcmf_remove_interface() call the brcmf_proto_detach() function is
called providing the following sequence:

  brcmf_detach()
    brcmf_proto_detach()
      brcmf_proto_msgbuf_detach()
        brcmf_flowring_detach()
          brcmf_msgbuf_delete_flowring()
            brcmf_msgbuf_remove_flowring()
              brcmf_flowring_delete()
                brcmf_get_ifp()
                brcmf_txfinalize()

Since brcmf_get_ip() can and actually will return NULL in this case the
call to brcmf_txfinalize() will result in a NULL pointer dereference inside
brcmf_txfinalize() when trying to update ifp->ndev->stats.tx_errors.

This will only happen if a flowring still has an skb.

Although the NULL pointer dereference has only been seen when trying to
update the tx statistic, all other uses of the ifp pointer have been
guarded as well with an early return if ifp is NULL.

Cc: stable@vger.kernel.org
Signed-off-by: Marcel Hamer <marcel.hamer@windriver.com>
Link: https://lore.kernel.org/all/b519e746-ddfd-421f-d897-7620d229e4b2@gmail.com/
Acked-by: Arend van Spriel  <arend.vanspriel@broadcom.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://patch.msgid.link/20250116132240.731039-1-marcel.hamer@windriver.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2025-02-17 10:05:14 +01:00
arch KVM: s390: vsie: fix some corner-cases when grabbing vsie pages 2025-02-17 10:05:06 +01:00
block blk-cgroup: Fix class @block_class's subsystem refcount leakage 2025-02-17 10:05:12 +01:00
certs sign-file,extract-cert: use pkcs11 provider for OPENSSL MAJOR >= 3 2024-09-20 19:52:48 +03:00
crypto crypto: api - Fix boot-up self-test race 2025-02-08 09:57:28 +01:00
Documentation arm64: Filter out SVE hwcaps when FEAT_SVE isn't implemented 2025-02-17 10:05:04 +01:00
drivers wifi: brcmfmac: fix NULL pointer dereference in brcmf_txfinalize() 2025-02-17 10:05:14 +01:00
fs ksmbd: fix integer overflows on 32 bit systems 2025-02-17 10:05:06 +01:00
include scsi: ufs: core: Fix the HIGH/LOW_TEMP Bit Definitions 2025-02-17 10:05:12 +01:00
init Compiler Attributes: disable __counted_by for clang < 19.1.3 2024-12-05 14:02:45 +01:00
io_uring io_uring/uring_cmd: use cached cmd_op in io_uring_cmd_sock() 2025-02-08 09:58:10 +01:00
ipc ipc: fix memleak if msg_init_ns failed in create_ipc_ns 2024-12-05 14:03:02 +01:00
kernel ring-buffer: Do not allow events in NMI with generic atomic64 cmpxchg() 2025-02-17 10:05:14 +01:00
lib atomic64: Use arch_spin_locks instead of raw_spin_locks 2025-02-17 10:05:14 +01:00
LICENSES LICENSES: add 0BSD license text 2024-09-01 20:43:24 -07:00
mm memcg: fix soft lockup in the OOM process 2025-02-08 09:58:19 +01:00
net Bluetooth: L2CAP: accept zero as a special value for MTU auto-selection 2025-02-17 10:05:09 +01:00
rust rust: kbuild: set bindgen's Rust target version 2024-12-19 18:13:22 +01:00
samples samples/landlock: Fix possible NULL dereference in parse_path() 2025-02-08 09:57:11 +01:00
scripts kbuild: switch from lz4c to lz4 for compression 2025-02-08 09:58:12 +01:00
security KEYS: trusted: dcp: fix improper sg use with CONFIG_VMAP_STACK=y 2025-02-17 10:05:09 +01:00
sound ALSA: hda/realtek: Enable Mute LED on HP Laptop 14s-fq1xxx 2025-02-17 10:05:03 +01:00
tools perf bench: Fix undefined behavior in cmpworker() 2025-02-17 10:05:12 +01:00
usr initramfs: shorten cmd_initfs in usr/Makefile 2024-07-16 01:07:52 +09:00
virt KVM: x86: switch hugepage recovery thread to vhost_task 2024-12-05 14:02:43 +01:00
.clang-format clang-format: Update with v6.11-rc1's for_each macro list 2024-08-02 13:20:31 +02:00
.cocciconfig scripts: add Linux .cocciconfig for coccinelle 2016-07-22 12:13:39 +02:00
.editorconfig .editorconfig: remove trim_trailing_whitespace option 2024-06-13 16:47:52 +02:00
.get_maintainer.ignore Add Jeff Kirsher to .get_maintainer.ignore 2024-03-08 11:36:54 +00:00
.gitattributes .gitattributes: set diff driver for Rust source code files 2023-05-31 17:48:25 +02:00
.gitignore Kbuild updates for v6.12 2024-09-24 13:02:06 -07:00
.mailmap mailmap: add entry for Thorsten Blum 2024-11-07 14:14:59 -08:00
.rustfmt.toml rust: add .rustfmt.toml 2022-09-28 09:02:20 +02:00
COPYING COPYING: state that all contributions really are covered by this file 2020-02-10 13:32:20 -08:00
CREDITS MAINTAINERS: Remove self from DSA entry 2024-11-03 12:52:38 -08:00
Kbuild Kbuild updates for v6.1 2022-10-10 12:00:45 -07:00
Kconfig kbuild: ensure full rebuild when the compiler is updated 2020-05-12 13:28:33 +09:00
MAINTAINERS MAINTAINERS: update location of media main tree 2024-12-05 14:02:42 +01:00
Makefile Linux 6.12.13 2025-02-08 09:58:20 +01:00
README README: Fix spelling 2024-03-18 03:36:32 -06:00

README 

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the reStructuredText markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.