wireless: ath9k-htc: fix possible use after free

PATCH New Ming Lei 2 participants 3 messages Sep 13, 2012 – Sep 27, 2012 Qualcomm Atheros ATH9K wireless driver

Share & tools

Ming Lei

author

2012-09-13 02:33 UTC #0 lore raw

PATCH 1/1 wireless: ath9k-htc: fix possible use after free

Inside ath9k_hif_usb_firmware_fail(), the instance of 'struct struct hif_device_usb' may be freed by ath9k_hif_usb_disconnect() after

	complete(&hif_dev->fw_done);

But 'hif_dev' is still accessed after the line code above is executed.

This patch fixes the issue by not accessing 'hif_dev' after 'complete(&hif_dev->fw_done)' inside ath9k_hif_usb_firmware_fail().

Cc ath9k-devel at lists.ath9k.org

Cc "Luis R. Rodriguez" <[email protected]>

Cc Jouni Malinen <[email protected]>

Cc Vasanthakumar Thiagarajan <[email protected]>

Cc Senthil Balasubramanian <[email protected]>

Cc "John W. Linville" <[email protected]>

Signed-off-by Ming Lei <[email protected]>

---
 drivers/net/wireless/ath/ath9k/hif_usb.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

drivers/net/wireless/ath/ath9k/hif_usb.c +3 -2

index ee6e50a..924c461 100644
@@ -1072,14 +1072,15 @@ static void ath9k_hif_usb_dev_deinit(struct hif_device_usb *hif_dev)
  */
 static void ath9k_hif_usb_firmware_fail(struct hif_device_usb *hif_dev)
 {
-	struct device *parent = hif_dev->udev->dev.parent;
+	struct device *dev = &hif_dev->udev->dev;
+	struct device *parent = dev->parent;
 
 	complete(&hif_dev->fw_done);
 
 	if (parent)
 		device_lock(parent);
 
-	device_release_driver(&hif_dev->udev->dev);
+	device_release_driver(dev);
 
 	if (parent)
 		device_unlock(parent);

Signature · 1 line

1.7.9.5

Ming Lei

author

2012-09-27 04:06 UTC #1 lore raw

PATCH 1/1 wireless: ath9k-htc: fix possible use after free

Quoted 13 lines · Ming Lei

Inside ath9k_hif_usb_firmware_fail(), the instance of 'struct struct hif_device_usb' may be freed by ath9k_hif_usb_disconnect() after
        complete(&hif_dev->fw_done);
But 'hif_dev' is still accessed after the line code above is executed.
This patch fixes the issue by not accessing 'hif_dev' after 'complete(&hif_dev->fw_done)' inside ath9k_hif_usb_firmware_fail().

Quoted 6 lines

Cc ath9k-devel at lists.ath9k.org
Cc "Luis R. Rodriguez" <[email protected]>
Cc Jouni Malinen <[email protected]>
Cc Vasanthakumar Thiagarajan <[email protected]>
Cc Senthil Balasubramanian <[email protected]>
Cc "John W. Linville" <[email protected]>

Gentle ping, :-)

Thanks,
--
Ming Lei

John W. Linville

2012-09-27 21:24 UTC #2 lore raw

PATCH 1/1 wireless: ath9k-htc: fix possible use after free

Quoted 14 lines · Ming Lei

Quoted 13 lines · Ming Lei
Inside ath9k_hif_usb_firmware_fail(), the instance of 'struct struct hif_device_usb' may be freed by ath9k_hif_usb_disconnect() after
        complete(&hif_dev->fw_done);
But 'hif_dev' is still accessed after the line code above is executed.
This patch fixes the issue by not accessing 'hif_dev' after 'complete(&hif_dev->fw_done)' inside ath9k_hif_usb_firmware_fail().

Quoted 8 lines

Quoted 6 lines
Cc ath9k-devel at lists.ath9k.org
Cc "Luis R. Rodriguez" <[email protected]>
Cc Jouni Malinen <[email protected]>
Cc Vasanthakumar Thiagarajan <[email protected]>
Cc Senthil Balasubramanian <[email protected]>
Cc "John W. Linville" <[email protected]>
Gentle ping, :-)

This is commit e962610f8100e1b52973f5a9c855cbc3d1ba04ec in wireless-next?

Signature · 2 lines

John W. Linville		Someday the world will need a hero, and you
linville at tuxdriver.com			might be all we have.  Be ready.