]> git.baikalelectronics.ru Git - kernel.git/commit
ath10k: fix use-after-free in ath10k_wmi_cmd_send_nowait
authorCarl Huang <cjhuang@codeaurora.org>
Mon, 5 Mar 2018 06:44:02 +0000 (14:44 +0800)
committerKalle Valo <kvalo@codeaurora.org>
Mon, 26 Mar 2018 15:13:03 +0000 (18:13 +0300)
commitd21c34198d5d6f37049286e5b12e5fb40b8f93b7
treec2591ea97d34c1a197ff2826c1a9df0e4d25c0e9
parentb10c642626e5ca230af177fb50c3c2bd5edfbbb4
ath10k: fix use-after-free in ath10k_wmi_cmd_send_nowait

The skb may be freed in tx completion context before
trace_ath10k_wmi_cmd is called. This can be easily captured when
KASAN(Kernel Address Sanitizer) is enabled. The fix is to move
trace_ath10k_wmi_cmd before the send operation. As the ret has no
meaning in trace_ath10k_wmi_cmd then, so remove this parameter too.

Signed-off-by: Carl Huang <cjhuang@codeaurora.org>
Tested-by: Brian Norris <briannorris@chromium.org>
Reviewed-by: Brian Norris <briannorris@chromium.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
drivers/net/wireless/ath/ath10k/trace.h
drivers/net/wireless/ath/ath10k/wmi.c