summaryrefslogtreecommitdiffstats
path: root/net/wireless/reg.c
diff options
context:
space:
mode:
authorJohannes Berg <johannes.berg@intel.com>2013-01-09 12:01:38 +0100
committerJohannes Berg <johannes.berg@intel.com>2013-01-09 12:19:52 +0100
commit2d31986764926630a6df72123a5e217219b32594 (patch)
treec363b7d854e00b9791f8750100646d66301da832 /net/wireless/reg.c
parent4a484cffc5e1836114e9556f7c704412d491200c (diff)
downloadlinux-2d31986764926630a6df72123a5e217219b32594.tar.bz2
regulatory: fix restore_regulatory_settings
My commit 379b82f4c9dc6e67bf61aa61b096c06a2f320f60 ("regulatory: pass new regdomain to reset function") broke the restore_regulatory_settings() function due to a logic change. Consider this change: - reset_regdomains(true); - cfg80211_regdomain = cfg80211_world_regdom; + reset_regdomains(true, cfg80211_world_regdom); This looks innocent enough, until you realise that the called function (reset_regdomains) also resets the cfg80211_world_regdom pointer, so that the old version of the code would use the new object it pointed to and the new version of the code uses the old object. This lead to a double-free of this object. Since reset_regdomains() sets it to &world_regdom, use that directly. Reported-by: Sujith Manoharan <sujith@msujith.org> Tested-by: Sujith Manoharan <sujith@msujith.org> Reported-by: Bob Copeland <me@bobcopeland.com> Reported-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com> Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Diffstat (limited to 'net/wireless/reg.c')
-rw-r--r--net/wireless/reg.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 2193f62bb8ae..8c114e8a9135 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -1848,7 +1848,7 @@ static void restore_regulatory_settings(bool reset_user)
mutex_lock(&cfg80211_mutex);
mutex_lock(&reg_mutex);
- reset_regdomains(true, cfg80211_world_regdom);
+ reset_regdomains(true, &world_regdom);
restore_alpha2(alpha2, reset_user);
/*