mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-21 18:11:39 +00:00
qtnfmac: fix using skb after free
[ Upstream commit 4a33f21cef
]
KASAN reported use-after-free error:
[ 995.220767] BUG: KASAN: use-after-free in qtnf_cmd_send_with_reply+0x169/0x3e0 [qtnfmac]
[ 995.221098] Read of size 2 at addr ffff888213d1ded0 by task kworker/1:1/71
The issue in qtnf_cmd_send_with_reply impacts all the commands that do
not need response other then return code. For such commands, consume_skb
is used for response skb and right after that return code in response
skb is accessed.
Signed-off-by: Sergey Matyukevich <sergey.matyukevich.os@quantenna.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
95d6206eb5
commit
a9f6525550
1 changed files with 4 additions and 2 deletions
|
@ -83,6 +83,7 @@ static int qtnf_cmd_send_with_reply(struct qtnf_bus *bus,
|
|||
struct qlink_cmd *cmd;
|
||||
struct qlink_resp *resp = NULL;
|
||||
struct sk_buff *resp_skb = NULL;
|
||||
int resp_res = 0;
|
||||
u16 cmd_id;
|
||||
u8 mac_id;
|
||||
u8 vif_id;
|
||||
|
@ -113,6 +114,7 @@ static int qtnf_cmd_send_with_reply(struct qtnf_bus *bus,
|
|||
}
|
||||
|
||||
resp = (struct qlink_resp *)resp_skb->data;
|
||||
resp_res = le16_to_cpu(resp->result);
|
||||
ret = qtnf_cmd_check_reply_header(resp, cmd_id, mac_id, vif_id,
|
||||
const_resp_size);
|
||||
if (ret)
|
||||
|
@ -128,8 +130,8 @@ static int qtnf_cmd_send_with_reply(struct qtnf_bus *bus,
|
|||
else
|
||||
consume_skb(resp_skb);
|
||||
|
||||
if (!ret && resp)
|
||||
return qtnf_cmd_resp_result_decode(le16_to_cpu(resp->result));
|
||||
if (!ret)
|
||||
return qtnf_cmd_resp_result_decode(resp_res);
|
||||
|
||||
pr_warn("VIF%u.%u: cmd 0x%.4X failed: %d\n",
|
||||
mac_id, vif_id, cmd_id, ret);
|
||||
|
|
Loading…
Reference in a new issue