leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

wireless: ath9k-htc: fix possible use after free

Browse Source 
Inside ath9k_hif_usb_firmware_fail(), the instance of
'struct struct hif_device_usb' may be freed by
ath9k_hif_usb_disconnect() after

	complete(&hif_dev->fw_done);

But 'hif_dev' is still accessed after the line code
above is executed.

This patch fixes the issue by not accessing 'hif_dev'
after 'complete(&hif_dev->fw_done)' inside
ath9k_hif_usb_firmware_fail().

Cc: ath9k-devel@lists.ath9k.org
Cc: "Luis R. Rodriguez" <mcgrof@qca.qualcomm.com>
Cc: Jouni Malinen <jouni@qca.qualcomm.com>
Cc: Vasanthakumar Thiagarajan <vthiagar@qca.qualcomm.com>
Cc: Senthil Balasubramanian <senthilb@qca.qualcomm.com>
Cc: "John W. Linville" <linville@tuxdriver.com>
Signed-off-by: Ming Lei <ming.lei@canonical.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
This commit is contained in:
Ming Lei 2012-09-13 10:33:28 +08:00 committed by John W. Linville
parent 7a03414686
commit e962610f81
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
drivers/net/wireless/ath/ath9k/hif_usb.c
View File

@ -1072,14 +1072,15 @@ static void ath9k_hif_usb_dev_deinit(struct hif_device_usb *hif_dev)
*/
static void ath9k_hif_usb_firmware_fail(struct hif_device_usb *hif_dev)
{
struct device *parent = hif_dev->udev->dev.parent;
struct device *dev = &hif_dev->udev->dev;
struct device *parent = dev->parent;
complete(&hif_dev->fw_done);
if (parent)
device_lock(parent);
device_release_driver(&hif_dev->udev->dev);
device_release_driver(dev);
if (parent)
device_unlock(parent);