]> git.baikalelectronics.ru Git - kernel.git/commit
iwlwifi: mvm: avoid use after free for pmsr request
authorAvraham Stern <avraham.stern@intel.com>
Fri, 31 Jan 2020 13:45:27 +0000 (15:45 +0200)
committerKalle Valo <kvalo@codeaurora.org>
Mon, 3 Feb 2020 18:09:11 +0000 (20:09 +0200)
commit24e78fe3d28263574648ff97f9cd7044bd36855b
tree29fd612356728c3a39771cb869f6da007b14c40d
parentefb649e93b1fcc407defabc3733f0b670e622654
iwlwifi: mvm: avoid use after free for pmsr request

When a FTM request is aborted, the driver sends the abort command to
the fw and waits for a response. When the response arrives, the driver
calls cfg80211_pmsr_complete() for that request.
However, cfg80211 frees the requested data immediately after sending
the abort command, so this may lead to use after free.

Fix it by clearing the request data in the driver when the abort
command arrives and ignoring the fw notification that will come
afterwards.

Signed-off-by: Avraham Stern <avraham.stern@intel.com>
Fixes: 15555857d37b ("iwlwifi: mvm: support FTM initiator")
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
drivers/net/wireless/intel/iwlwifi/mvm/ftm-initiator.c