diff options
| author | Fedor Pchelkin <pchelkin@ispras.ru> | 2022-10-08 14:49:17 +0300 |
|---|---|---|
| committer | Kalle Valo <quic_kvalo@quicinc.com> | 2022-10-11 07:39:54 +0300 |
| commit | dd95f2239fc846795fc926787c3ae0ca701c9840 (patch) | |
| tree | c49a825b6f6c17f8e3824a057a202e78f394c98f /drivers/net/wireless/ath/ath9k/recv.c | |
| parent | d174768932a89c20f2ef6dee2602221143995c29 (diff) | |
| download | linux-dd95f2239fc846795fc926787c3ae0ca701c9840.tar.xz | |
wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb()
It is possible that skb is freed in ath9k_htc_rx_msg(), then
usb_submit_urb() fails and we try to free skb again. It causes
use-after-free bug. Moreover, if alloc_skb() fails, urb->context becomes
NULL but rx_buf is not freed and there can be a memory leak.
The patch removes unnecessary nskb and makes skb processing more clear: it
is supposed that ath9k_htc_rx_msg() either frees old skb or passes its
managing to another callback function.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
Fixes: 3deff76095c4 ("ath9k_htc: Increase URB count for REG_IN pipe")
Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://lore.kernel.org/r/20221008114917.21404-1-pchelkin@ispras.ru
Diffstat (limited to 'drivers/net/wireless/ath/ath9k/recv.c')
0 files changed, 0 insertions, 0 deletions