]> git.baikalelectronics.ru Git - kernel.git/commit
qtnfmac: fix using skb after free
authorSergey Matyukevich <sergey.matyukevich.os@quantenna.com>
Wed, 13 Nov 2019 11:06:47 +0000 (11:06 +0000)
committerKalle Valo <kvalo@codeaurora.org>
Thu, 14 Nov 2019 15:28:47 +0000 (17:28 +0200)
commit4fc99e08a958777d712460489bd4320f28d84e4a
tree71fa7cbe97a4f4f9c6da120589cf9cddfdfa7771
parent38f8aadeac2c1d0a567f80573c58e8645f97b44d
qtnfmac: fix using skb after free

KASAN reported use-after-free error:

[  995.220767] BUG: KASAN: use-after-free in qtnf_cmd_send_with_reply+0x169/0x3e0 [qtnfmac]
[  995.221098] Read of size 2 at addr ffff888213d1ded0 by task kworker/1:1/71

The issue in qtnf_cmd_send_with_reply impacts all the commands that do
not need response other then return code. For such commands, consume_skb
is used for response skb and right after that return code in response
skb is accessed.

Signed-off-by: Sergey Matyukevich <sergey.matyukevich.os@quantenna.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
drivers/net/wireless/quantenna/qtnfmac/commands.c