libertas: don't exit from lbs_ibss_join_existing() with RCU read lock held
[ Upstream commitc7bf1fb7dd
] Commite5e884b426
("libertas: Fix two buffer overflows at parsing bss descriptor") introduced a bounds check on the number of supplied rates to lbs_ibss_join_existing(). Unfortunately, it introduced a return path from within a RCU read side critical section without a corresponding rcu_read_unlock(). Fix this. Fixes:e5e884b426
("libertas: Fix two buffer overflows at parsing bss descriptor") Signed-off-by: Nicolai Stange <nstange@suse.de> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
committed by
Greg Kroah-Hartman
parent
4dd90d14f9
commit
03b4aeda9b
@ -1853,6 +1853,7 @@ static int lbs_ibss_join_existing(struct lbs_private *priv,
|
|||||||
rates_max = rates_eid[1];
|
rates_max = rates_eid[1];
|
||||||
if (rates_max > MAX_RATES) {
|
if (rates_max > MAX_RATES) {
|
||||||
lbs_deb_join("invalid rates");
|
lbs_deb_join("invalid rates");
|
||||||
|
rcu_read_unlock();
|
||||||
goto out;
|
goto out;
|
||||||
}
|
}
|
||||||
rates = cmd.bss.rates;
|
rates = cmd.bss.rates;
|
||||||
|
Reference in New Issue
Block a user