]> git.proxmox.com Git - mirror_ubuntu-bionic-kernel.git/commit
ath10k: fix use-after-free in ath10k_wmi_cmd_send_nowait
authorCarl Huang <cjhuang@codeaurora.org>
Mon, 5 Mar 2018 06:44:02 +0000 (14:44 +0800)
committerJuerg Haefliger <juergh@canonical.com>
Wed, 24 Jul 2019 01:53:01 +0000 (19:53 -0600)
commitfd203d04f41b924d0ddc15cd6232b1a4b29e96cf
tree03e27f5f5bac665242285b382a40f7c0bf362a96
parent35ec573783cb8be4a6a7fe8f2692873632484018
ath10k: fix use-after-free in ath10k_wmi_cmd_send_nowait

BugLink: https://bugs.launchpad.net/bugs/1836426
commit 9ef0f58ed7b4a55da4a64641d538e0d9e46579ac upstream.

The skb may be freed in tx completion context before
trace_ath10k_wmi_cmd is called. This can be easily captured when
KASAN(Kernel Address Sanitizer) is enabled. The fix is to move
trace_ath10k_wmi_cmd before the send operation. As the ret has no
meaning in trace_ath10k_wmi_cmd then, so remove this parameter too.

Signed-off-by: Carl Huang <cjhuang@codeaurora.org>
Tested-by: Brian Norris <briannorris@chromium.org>
Reviewed-by: Brian Norris <briannorris@chromium.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>
drivers/net/wireless/ath/ath10k/trace.h
drivers/net/wireless/ath/ath10k/wmi.c