From abd39c6ded9db53aa44c2540092bdd5fb6590fa8 Mon Sep 17 00:00:00 2001
From: Sanjay Konduri <sanjay.konduri@redpinesignals.com>
Date: Tue, 15 May 2018 14:34:30 +0530
Subject: [PATCH] rsi: add fix for crash during assertions
Git-commit: abd39c6ded9db53aa44c2540092bdd5fb6590fa8
Patch-mainline: v4.18-rc1
References: CVE-2018-21008,bsc#1149591
Observed crash in some scenarios when assertion has occurred,
this is because hw structure is freed and is tried to get
accessed in some functions where null check is already
present. So, avoided the crash by making the hw to NULL after
freeing.
Signed-off-by: Sanjay Konduri <sanjay.konduri@redpinesignals.com>
Signed-off-by: Sushant Kumar Mishra <sushant.mishra@redpinesignals.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Acked-by: Takashi Iwai <tiwai@suse.de>
---
drivers/net/wireless/rsi/rsi_91x_mac80211.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/wireless/rsi/rsi_91x_mac80211.c b/drivers/net/wireless/rsi/rsi_91x_mac80211.c
index 3faa0449a5ef..bfa7569c85bb 100644
--- a/drivers/net/wireless/rsi/rsi_91x_mac80211.c
+++ b/drivers/net/wireless/rsi/rsi_91x_mac80211.c
@@ -245,6 +245,7 @@ void rsi_mac80211_detach(struct rsi_hw *adapter)
ieee80211_stop_queues(hw);
ieee80211_unregister_hw(hw);
ieee80211_free_hw(hw);
+ adapter->hw = NULL;
}
for (band = 0; band < NUM_NL80211_BANDS; band++) {
--
2.16.4