lkml.org 
[lkml]   [2022]   [Jun]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
SubjectRe: [PATCH v5 1/2] ath9k: fix use-after-free in ath9k_hif_usb_rx_cb
From
Hi Hillf,

On 5/22/22 07:15, Hillf Danton wrote:
>
> In the call chain below
>
> ath9k_hif_usb_firmware_cb()
> ath9k_htc_hw_alloc()
> ath9k_hif_usb_dev_init()
> ret = ath9k_htc_hw_init()
> ath9k_htc_probe_device()
> htc_handle->drv_priv = priv;
> ret = ath9k_htc_wait_for_target(priv);
> if (ret)
> goto err_free;
> if (ret)
> goto err_htc_hw_init;
>
> err_free:
> ieee80211_free_hw(hw);
>
>
> err_htc_hw_init:
> ath9k_hif_usb_dev_deinit(hif_dev);
> ath9k_hif_usb_dealloc_urbs()
> err_dev_init:
> ath9k_htc_hw_free(hif_dev->htc_handle);
> err_dev_alloc:
> release_firmware(fw);
> err_fw:
> ath9k_hif_usb_firmware_fail(hif_dev);
>
>
> hw should survive deallocating urbs, and changes should be added instead to
> the rollback in ath9k_htc_probe_device() by deferring cleanup of hw to its
> callsite in addition to urbs.
>

Don't get it, sorry. I am not changing the life time of `hw`, I am just
deferring htc_handle->drv_priv initialization.




With regards,
Pavel Skripkin
[unhandled content-type:application/pgp-signature]
\
 
 \ /
  Last update: 2022-06-10 15:02    [W:0.021 / U:0.244 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site