* [PATCH] wireless: ath10k: Fix a use after free in ath10k_htc_send_bundle
@ 2021-03-29 12:01 Lv Yunlong
2021-04-13 16:15 ` lyl2019
2021-04-22 13:54 ` Kalle Valo
0 siblings, 2 replies; 3+ messages in thread
From: Lv Yunlong @ 2021-03-29 12:01 UTC (permalink / raw)
To: kvalo, davem, kuba
Cc: ath10k, linux-wireless, netdev, linux-kernel, Lv Yunlong
In ath10k_htc_send_bundle, the bundle_skb could be freed by
dev_kfree_skb_any(bundle_skb). But the bundle_skb is used later
by bundle_skb->len.
As skb_len = bundle_skb->len, my patch replaces bundle_skb->len to
skb_len after the bundle_skb was freed.
Fixes: c8334512f3dd1 ("ath10k: add htt TX bundle for sdio")
Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
---
drivers/net/wireless/ath/ath10k/htc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/ath/ath10k/htc.c b/drivers/net/wireless/ath/ath10k/htc.c
index 0a37be6a7d33..fab398046a3f 100644
--- a/drivers/net/wireless/ath/ath10k/htc.c
+++ b/drivers/net/wireless/ath/ath10k/htc.c
@@ -669,7 +669,7 @@ static int ath10k_htc_send_bundle(struct ath10k_htc_ep *ep,
ath10k_dbg(ar, ATH10K_DBG_HTC,
"bundle tx status %d eid %d req count %d count %d len %d\n",
- ret, ep->eid, skb_queue_len(&ep->tx_req_head), cn, bundle_skb->len);
+ ret, ep->eid, skb_queue_len(&ep->tx_req_head), cn, skb_len);
return ret;
}
--
2.25.1
_______________________________________________
ath10k mailing list
ath10k@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/ath10k
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] wireless: ath10k: Fix a use after free in ath10k_htc_send_bundle
2021-03-29 12:01 [PATCH] wireless: ath10k: Fix a use after free in ath10k_htc_send_bundle Lv Yunlong
@ 2021-04-13 16:15 ` lyl2019
2021-04-22 13:54 ` Kalle Valo
1 sibling, 0 replies; 3+ messages in thread
From: lyl2019 @ 2021-04-13 16:15 UTC (permalink / raw)
To: Lv Yunlong
Cc: kvalo, davem, kuba, ath10k, linux-wireless, netdev, linux-kernel
Hi, maintainers of kerenl.
I submitted this patch two weeks ago, but it still hasn't been reviewed.
Could you help to review this patch? It will not take you much time.
Thank you very much.
> -----原始邮件-----
> 发件人: "Lv Yunlong" <lyl2019@mail.ustc.edu.cn>
> 发送时间: 2021-03-29 20:01:54 (星期一)
> 收件人: kvalo@codeaurora.org, davem@davemloft.net, kuba@kernel.org
> 抄送: ath10k@lists.infradead.org, linux-wireless@vger.kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, "Lv Yunlong" <lyl2019@mail.ustc.edu.cn>
> 主题: [PATCH] wireless: ath10k: Fix a use after free in ath10k_htc_send_bundle
>
> In ath10k_htc_send_bundle, the bundle_skb could be freed by
> dev_kfree_skb_any(bundle_skb). But the bundle_skb is used later
> by bundle_skb->len.
>
> As skb_len = bundle_skb->len, my patch replaces bundle_skb->len to
> skb_len after the bundle_skb was freed.
>
> Fixes: c8334512f3dd1 ("ath10k: add htt TX bundle for sdio")
> Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
> ---
> drivers/net/wireless/ath/ath10k/htc.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/net/wireless/ath/ath10k/htc.c b/drivers/net/wireless/ath/ath10k/htc.c
> index 0a37be6a7d33..fab398046a3f 100644
> --- a/drivers/net/wireless/ath/ath10k/htc.c
> +++ b/drivers/net/wireless/ath/ath10k/htc.c
> @@ -669,7 +669,7 @@ static int ath10k_htc_send_bundle(struct ath10k_htc_ep *ep,
>
> ath10k_dbg(ar, ATH10K_DBG_HTC,
> "bundle tx status %d eid %d req count %d count %d len %d\n",
> - ret, ep->eid, skb_queue_len(&ep->tx_req_head), cn, bundle_skb->len);
> + ret, ep->eid, skb_queue_len(&ep->tx_req_head), cn, skb_len);
> return ret;
> }
>
> --
> 2.25.1
>
_______________________________________________
ath10k mailing list
ath10k@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/ath10k
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] wireless: ath10k: Fix a use after free in ath10k_htc_send_bundle
2021-03-29 12:01 [PATCH] wireless: ath10k: Fix a use after free in ath10k_htc_send_bundle Lv Yunlong
2021-04-13 16:15 ` lyl2019
@ 2021-04-22 13:54 ` Kalle Valo
1 sibling, 0 replies; 3+ messages in thread
From: Kalle Valo @ 2021-04-22 13:54 UTC (permalink / raw)
To: Lv Yunlong
Cc: davem, kuba, ath10k, linux-wireless, netdev, linux-kernel, Lv Yunlong
Lv Yunlong <lyl2019@mail.ustc.edu.cn> wrote:
> In ath10k_htc_send_bundle, the bundle_skb could be freed by
> dev_kfree_skb_any(bundle_skb). But the bundle_skb is used later
> by bundle_skb->len.
>
> As skb_len = bundle_skb->len, my patch replaces bundle_skb->len to
> skb_len after the bundle_skb was freed.
>
> Fixes: c8334512f3dd1 ("ath10k: add htt TX bundle for sdio")
> Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Patch applied to ath-next branch of ath.git, thanks.
8392df5d7e0b ath10k: Fix a use after free in ath10k_htc_send_bundle
--
https://patchwork.kernel.org/project/linux-wireless/patch/20210329120154.8963-1-lyl2019@mail.ustc.edu.cn/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
_______________________________________________
ath10k mailing list
ath10k@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/ath10k
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2021-04-22 13:55 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-03-29 12:01 [PATCH] wireless: ath10k: Fix a use after free in ath10k_htc_send_bundle Lv Yunlong
2021-04-13 16:15 ` lyl2019
2021-04-22 13:54 ` Kalle Valo
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).