lkml.org 
[lkml]   [2020]   [Sep]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH] wireless: ath9k: hif_usb: fix race condition between usb_get_urb() and usb_kill_anchored_urbs()
From
Date
On 9/21/20 9:05 AM, Kalle Valo wrote:
> Brooke Basile <brookebasile@gmail.com> wrote:
>
>> Calls to usb_kill_anchored_urbs() after usb_kill_urb() on multiprocessor
>> systems create a race condition in which usb_kill_anchored_urbs() deallocates
>> the URB before the completer callback is called in usb_kill_urb(), resulting
>> in a use-after-free.
>> To fix this, add proper lock protection to usb_kill_urb() calls that can
>> possibly run concurrently with usb_kill_anchored_urbs().
>>
>> Reported-by: syzbot+89bd486af9427a9fc605@syzkaller.appspotmail.com
>> Link: https://syzkaller.appspot.com/bug?id=cabffad18eb74197f84871802fd2c5117b61febf
>> Signed-off-by: Brooke Basile <brookebasile@gmail.com>
>> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
>
> Patch applied to ath-next branch of ath.git, thanks.
>
> 03fb92a432ea ath9k: hif_usb: fix race condition between usb_get_urb() and usb_kill_anchored_urbs()
>

Thank you! :)

Best,
Brooke Basile

\
 
 \ /
  Last update: 2020-09-22 01:05    [W:0.726 / U:0.188 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site