diff options
| author | Ming Lei <ming.lei@canonical.com> | 2012-09-13 02:33:28 (GMT) |
|---|---|---|
| committer | John W. Linville <linville@tuxdriver.com> | 2012-09-24 18:59:07 (GMT) |
| commit | e962610f8100e1b52973f5a9c855cbc3d1ba04ec (patch) | |
| tree | d84c4d149bb6624b972e07d6cdf32eaeb1d6ae2d | |
| parent | 7a03414686d8e01c660bf69df22cafcfd2753626 (diff) | |
| download | linux-fsl-qoriq-e962610f8100e1b52973f5a9c855cbc3d1ba04ec.tar.xz | |
wireless: ath9k-htc: fix possible use after free
Inside ath9k_hif_usb_firmware_fail(), the instance of
'struct struct hif_device_usb' may be freed by
ath9k_hif_usb_disconnect() after
complete(&hif_dev->fw_done);
But 'hif_dev' is still accessed after the line code
above is executed.
This patch fixes the issue by not accessing 'hif_dev'
after 'complete(&hif_dev->fw_done)' inside
ath9k_hif_usb_firmware_fail().
Cc: ath9k-devel@lists.ath9k.org
Cc: "Luis R. Rodriguez" <mcgrof@qca.qualcomm.com>
Cc: Jouni Malinen <jouni@qca.qualcomm.com>
Cc: Vasanthakumar Thiagarajan <vthiagar@qca.qualcomm.com>
Cc: Senthil Balasubramanian <senthilb@qca.qualcomm.com>
Cc: "John W. Linville" <linville@tuxdriver.com>
Signed-off-by: Ming Lei <ming.lei@canonical.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
| -rw-r--r-- | drivers/net/wireless/ath/ath9k/hif_usb.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c index ee6e50a..924c461 100644 --- a/drivers/net/wireless/ath/ath9k/hif_usb.c +++ b/drivers/net/wireless/ath/ath9k/hif_usb.c @@ -1072,14 +1072,15 @@ static void ath9k_hif_usb_dev_deinit(struct hif_device_usb *hif_dev) */ static void ath9k_hif_usb_firmware_fail(struct hif_device_usb *hif_dev) { - struct device *parent = hif_dev->udev->dev.parent; + struct device *dev = &hif_dev->udev->dev; + struct device *parent = dev->parent; complete(&hif_dev->fw_done); if (parent) device_lock(parent); - device_release_driver(&hif_dev->udev->dev); + device_release_driver(dev); if (parent) device_unlock(parent); |