Messages in this thread | | | Date | Fri, 10 Jun 2022 16:01:06 +0300 | Subject | Re: [PATCH v5 1/2] ath9k: fix use-after-free in ath9k_hif_usb_rx_cb | From | Pavel Skripkin <> |
| |
Hi Hillf,
On 5/22/22 07:15, Hillf Danton wrote: > > In the call chain below > > ath9k_hif_usb_firmware_cb() > ath9k_htc_hw_alloc() > ath9k_hif_usb_dev_init() > ret = ath9k_htc_hw_init() > ath9k_htc_probe_device() > htc_handle->drv_priv = priv; > ret = ath9k_htc_wait_for_target(priv); > if (ret) > goto err_free; > if (ret) > goto err_htc_hw_init; > > err_free: > ieee80211_free_hw(hw); > > > err_htc_hw_init: > ath9k_hif_usb_dev_deinit(hif_dev); > ath9k_hif_usb_dealloc_urbs() > err_dev_init: > ath9k_htc_hw_free(hif_dev->htc_handle); > err_dev_alloc: > release_firmware(fw); > err_fw: > ath9k_hif_usb_firmware_fail(hif_dev); > > > hw should survive deallocating urbs, and changes should be added instead to > the rollback in ath9k_htc_probe_device() by deferring cleanup of hw to its > callsite in addition to urbs. >
Don't get it, sorry. I am not changing the life time of `hw`, I am just deferring htc_handle->drv_priv initialization.
With regards, Pavel Skripkin [unhandled content-type:application/pgp-signature] | |