]> asedeno.scripts.mit.edu Git - linux.git/commit
qtnfmac: fix using skb after free
authorSergey Matyukevich <sergey.matyukevich.os@quantenna.com>
Wed, 13 Nov 2019 11:06:47 +0000 (11:06 +0000)
committerKalle Valo <kvalo@codeaurora.org>
Thu, 14 Nov 2019 15:28:47 +0000 (17:28 +0200)
commit4a33f21cef84b1b933958c99ed5dac1726214b35
tree71fa7cbe97a4f4f9c6da120589cf9cddfdfa7771
parent408f122a1f923011099468e9f317e6dbe200fd31
qtnfmac: fix using skb after free

KASAN reported use-after-free error:

[  995.220767] BUG: KASAN: use-after-free in qtnf_cmd_send_with_reply+0x169/0x3e0 [qtnfmac]
[  995.221098] Read of size 2 at addr ffff888213d1ded0 by task kworker/1:1/71

The issue in qtnf_cmd_send_with_reply impacts all the commands that do
not need response other then return code. For such commands, consume_skb
is used for response skb and right after that return code in response
skb is accessed.

Signed-off-by: Sergey Matyukevich <sergey.matyukevich.os@quantenna.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
drivers/net/wireless/quantenna/qtnfmac/commands.c