diff options
| author | Fedor Pchelkin <[email protected]> | 2022-10-08 14:49:17 +0300 |
|---|---|---|
| committer | Kalle Valo <[email protected]> | 2022-10-11 07:39:54 +0300 |
| commit | dd95f2239fc846795fc926787c3ae0ca701c9840 (patch) | |
| tree | c49a825b6f6c17f8e3824a057a202e78f394c98f /tools/perf/scripts/python/libxed.py | |
| parent | d174768932a89c20f2ef6dee2602221143995c29 (diff) | |
wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb()
It is possible that skb is freed in ath9k_htc_rx_msg(), then
usb_submit_urb() fails and we try to free skb again. It causes
use-after-free bug. Moreover, if alloc_skb() fails, urb->context becomes
NULL but rx_buf is not freed and there can be a memory leak.
The patch removes unnecessary nskb and makes skb processing more clear: it
is supposed that ath9k_htc_rx_msg() either frees old skb or passes its
managing to another callback function.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
Fixes: 3deff76095c4 ("ath9k_htc: Increase URB count for REG_IN pipe")
Signed-off-by: Fedor Pchelkin <[email protected]>
Signed-off-by: Alexey Khoroshilov <[email protected]>
Acked-by: Toke Høiland-Jørgensen <[email protected]>
Signed-off-by: Kalle Valo <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Diffstat (limited to 'tools/perf/scripts/python/libxed.py')
0 files changed, 0 insertions, 0 deletions