Messages in this thread | | | Subject | Re: [PATCH] wireless: ath9k: hif_usb: fix race condition between usb_get_urb() and usb_kill_anchored_urbs() | From | Brooke Basile <> | Date | Mon, 21 Sep 2020 19:04:38 -0400 |
| |
On 9/21/20 9:05 AM, Kalle Valo wrote: > Brooke Basile <brookebasile@gmail.com> wrote: > >> Calls to usb_kill_anchored_urbs() after usb_kill_urb() on multiprocessor >> systems create a race condition in which usb_kill_anchored_urbs() deallocates >> the URB before the completer callback is called in usb_kill_urb(), resulting >> in a use-after-free. >> To fix this, add proper lock protection to usb_kill_urb() calls that can >> possibly run concurrently with usb_kill_anchored_urbs(). >> >> Reported-by: syzbot+89bd486af9427a9fc605@syzkaller.appspotmail.com >> Link: https://syzkaller.appspot.com/bug?id=cabffad18eb74197f84871802fd2c5117b61febf >> Signed-off-by: Brooke Basile <brookebasile@gmail.com> >> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> > > Patch applied to ath-next branch of ath.git, thanks. > > 03fb92a432ea ath9k: hif_usb: fix race condition between usb_get_urb() and usb_kill_anchored_urbs() >
Thank you! :)
Best, Brooke Basile
| |