lkml.org 
[lkml]   [2019]   [Jul]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.1 027/138] iwlwifi: Fix double-free problems in iwl_req_fw_callback()
    Date
    [ Upstream commit a8627176b0de7ba3f4524f641ddff4abf23ae4e4 ]

    In the error handling code of iwl_req_fw_callback(), iwl_dealloc_ucode()
    is called to free data. In iwl_drv_stop(), iwl_dealloc_ucode() is called
    again, which can cause double-free problems.

    To fix this bug, the call to iwl_dealloc_ucode() in
    iwl_req_fw_callback() is deleted.

    This bug is found by a runtime fuzzing tool named FIZZER written by us.

    Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
    Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
    Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/net/wireless/intel/iwlwifi/iwl-drv.c | 1 -
    1 file changed, 1 deletion(-)

    diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
    index 689a65b11cc3..4fd1737d768b 100644
    --- a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
    +++ b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
    @@ -1579,7 +1579,6 @@ static void iwl_req_fw_callback(const struct firmware *ucode_raw, void *context)
    goto free;

    out_free_fw:
    - iwl_dealloc_ucode(drv);
    release_firmware(ucode_raw);
    out_unbind:
    complete(&drv->request_firmware_complete);
    --
    2.20.1


    \
     
     \ /
      Last update: 2019-07-12 14:40    [W:3.408 / U:0.060 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site