b43: Avoid possible double calls to b43_one_core_detach()
authorJia-Ju Bai <baijiaju1990@gmail.com>
Sat, 4 May 2019 09:10:00 +0000 (17:10 +0800)
committerKalle Valo <kvalo@codeaurora.org>
Tue, 28 May 2019 12:43:34 +0000 (15:43 +0300)
commitec2e93cf1910d4517bb68cd67f2925665c5ef005
treeb365fc138a6ad3d07f804e3036b68fe8b270930d
parentaeffda6b10f8d4cf1c5bb10eac30a7a47f7ce184
b43: Avoid possible double calls to b43_one_core_detach()

In b43_request_firmware(), when ieee80211_register_hw() fails,
b43_one_core_detach() is called. In b43_bcma_remove() and
b43_ssb_remove(), b43_one_core_detach() is called again. In this case,
null-pointer dereferences and double-free problems can occur when
the driver is removed.

To fix this bug, the call to b43_one_core_detach() in
b43_request_firmware() is deleted.

This bug is found by a runtime fuzzing tool named FIZZER written by us.

Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
drivers/net/wireless/broadcom/b43/main.c