2012-09-13 02:33:45

by Ming Lei

Subject: [PATCH -next] wireless: ath9k-htc: fix possible use after free

Inside ath9k_hif_usb_firmware_fail(), the instance of
'struct struct hif_device_usb' may be freed by
ath9k_hif_usb_disconnect() after

complete(&hif_dev->fw_done);

But 'hif_dev' is still accessed after the line code
above is executed.

This patch fixes the issue by not accessing 'hif_dev'
after 'complete(&hif_dev->fw_done)' inside
ath9k_hif_usb_firmware_fail().

Cc: [email protected]
Cc: "Luis R. Rodriguez" <[email protected]>
Cc: Jouni Malinen <[email protected]>
Cc: Vasanthakumar Thiagarajan <[email protected]>
Cc: Senthil Balasubramanian <[email protected]>
Cc: "John W. Linville" <[email protected]>
Signed-off-by: Ming Lei <[email protected]>
---
drivers/net/wireless/ath/ath9k/hif_usb.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c
index ee6e50a..924c461 100644
--- a/drivers/net/wireless/ath/ath9k/hif_usb.c
+++ b/drivers/net/wireless/ath/ath9k/hif_usb.c
@@ -1072,14 +1072,15 @@ static void ath9k_hif_usb_dev_deinit(struct hif_device_usb *hif_dev)
*/
static void ath9k_hif_usb_firmware_fail(struct hif_device_usb *hif_dev)
{
- struct device *parent = hif_dev->udev->dev.parent;
+ struct device *dev = &hif_dev->udev->dev;
+ struct device *parent = dev->parent;

complete(&hif_dev->fw_done);

if (parent)
device_lock(parent);

- device_release_driver(&hif_dev->udev->dev);
+ device_release_driver(dev);

if (parent)
device_unlock(parent);
--
1.7.9.5

2012-09-27 21:30:47

by John W. Linville

Subject: Re: [PATCH -next] wireless: ath9k-htc: fix possible use after free

On Thu, Sep 27, 2012 at 12:06:17PM +0800, Ming Lei wrote:
> On Thu, Sep 13, 2012 at 10:33 AM, Ming Lei <[email protected]> wrote:
> > Inside ath9k_hif_usb_firmware_fail(), the instance of
> > 'struct struct hif_device_usb' may be freed by
> > ath9k_hif_usb_disconnect() after
> >
> > complete(&hif_dev->fw_done);
> >
> > But 'hif_dev' is still accessed after the line code
> > above is executed.
> >
> > This patch fixes the issue by not accessing 'hif_dev'
> > after 'complete(&hif_dev->fw_done)' inside
> > ath9k_hif_usb_firmware_fail().
> >
> > Cc: [email protected]
> > Cc: "Luis R. Rodriguez" <[email protected]>
> > Cc: Jouni Malinen <[email protected]>
> > Cc: Vasanthakumar Thiagarajan <[email protected]>
> > Cc: Senthil Balasubramanian <[email protected]>
> > Cc: "John W. Linville" <[email protected]>
>
> Gentle ping, :-)

This is commit e962610f8100e1b52973f5a9c855cbc3d1ba04ec in wireless-next?

--
John W. Linville Someday the world will need a hero, and you
[email protected] might be all we have. Be ready.

2012-09-27 04:06:19

by Ming Lei

Subject: Re: [PATCH -next] wireless: ath9k-htc: fix possible use after free

On Thu, Sep 13, 2012 at 10:33 AM, Ming Lei <[email protected]> wrote:
> Inside ath9k_hif_usb_firmware_fail(), the instance of
> 'struct struct hif_device_usb' may be freed by
> ath9k_hif_usb_disconnect() after
>
> complete(&hif_dev->fw_done);
>
> But 'hif_dev' is still accessed after the line code
> above is executed.
>
> This patch fixes the issue by not accessing 'hif_dev'
> after 'complete(&hif_dev->fw_done)' inside
> ath9k_hif_usb_firmware_fail().
>
> Cc: [email protected]
> Cc: "Luis R. Rodriguez" <[email protected]>
> Cc: Jouni Malinen <[email protected]>
> Cc: Vasanthakumar Thiagarajan <[email protected]>
> Cc: Senthil Balasubramanian <[email protected]>
> Cc: "John W. Linville" <[email protected]>

Gentle ping, :-)

Thanks,
--
Ming Lei