[PATCH] wireless: ath10k: Fix a use after free in ath10k_htc_send_bundle

Subsystems: atheros ath generic utilities, qualcomm atheros ath10k wireless driver, the rest

STALE1930d LANDED

Landed in mainline as 8392df5d7e0b on 2021-04-22.

3 messages, 2 authors, 2021-04-22 · open the first message on its own page

[PATCH] wireless: ath10k: Fix a use after free in ath10k_htc_send_bundle

From: Lv Yunlong <hidden>
Date: 2021-03-29 12:02:55 

In ath10k_htc_send_bundle, the bundle_skb could be freed by
dev_kfree_skb_any(bundle_skb). But the bundle_skb is used later
by bundle_skb->len.

As skb_len = bundle_skb->len, my patch replaces bundle_skb->len to
skb_len after the bundle_skb was freed.

Fixes: c8334512f3dd1 ("ath10k: add htt TX bundle for sdio")
Signed-off-by: Lv Yunlong <redacted>
---
 drivers/net/wireless/ath/ath10k/htc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ath/ath10k/htc.c b/drivers/net/wireless/ath/ath10k/htc.c
index 0a37be6a7d33..fab398046a3f 100644
--- a/drivers/net/wireless/ath/ath10k/htc.c
+++ b/drivers/net/wireless/ath/ath10k/htc.c
@@ -669,7 +669,7 @@ static int ath10k_htc_send_bundle(struct ath10k_htc_ep *ep,
 
 	ath10k_dbg(ar, ATH10K_DBG_HTC,
 		   "bundle tx status %d eid %d req count %d count %d len %d\n",
-		   ret, ep->eid, skb_queue_len(&ep->tx_req_head), cn, bundle_skb->len);
+		   ret, ep->eid, skb_queue_len(&ep->tx_req_head), cn, skb_len);
 	return ret;
 }
 
-- 
2.25.1

Re: [PATCH] wireless: ath10k: Fix a use after free in ath10k_htc_send_bundle

From: <hidden>
Date: 2021-04-13 16:15:48 

Hi, maintainers of kerenl.

    I submitted this patch two weeks ago, but it still hasn't been reviewed.
    Could you help to review this patch? It will not take you much time.

Thank you very much.
quoted hunk
-----原始邮件-----
发件人: "Lv Yunlong" [off-list ref]
发送时间: 2021-03-29 20:01:54 (星期一)
收件人: kvalo@codeaurora.org, davem@davemloft.net, kuba@kernel.org
抄送: ath10k@lists.infradead.org, linux-wireless@vger.kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, "Lv Yunlong" [off-list ref]
主题: [PATCH] wireless: ath10k: Fix a use after free in ath10k_htc_send_bundle

In ath10k_htc_send_bundle, the bundle_skb could be freed by
dev_kfree_skb_any(bundle_skb). But the bundle_skb is used later
by bundle_skb->len.

As skb_len = bundle_skb->len, my patch replaces bundle_skb->len to
skb_len after the bundle_skb was freed.

Fixes: c8334512f3dd1 ("ath10k: add htt TX bundle for sdio")
Signed-off-by: Lv Yunlong <redacted>
---
 drivers/net/wireless/ath/ath10k/htc.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ath/ath10k/htc.c b/drivers/net/wireless/ath/ath10k/htc.c
index 0a37be6a7d33..fab398046a3f 100644
--- a/drivers/net/wireless/ath/ath10k/htc.c
+++ b/drivers/net/wireless/ath/ath10k/htc.c
@@ -669,7 +669,7 @@ static int ath10k_htc_send_bundle(struct ath10k_htc_ep *ep,
 
 	ath10k_dbg(ar, ATH10K_DBG_HTC,
 		   "bundle tx status %d eid %d req count %d count %d len %d\n",
-		   ret, ep->eid, skb_queue_len(&ep->tx_req_head), cn, bundle_skb->len);
+		   ret, ep->eid, skb_queue_len(&ep->tx_req_head), cn, skb_len);
 	return ret;
 }
 
-- 
2.25.1

Re: [PATCH] wireless: ath10k: Fix a use after free in ath10k_htc_send_bundle

From: Kalle Valo <hidden>
Date: 2021-04-22 13:54:38 

Lv Yunlong [off-list ref] wrote:

In ath10k_htc_send_bundle, the bundle_skb could be freed by
dev_kfree_skb_any(bundle_skb). But the bundle_skb is used later
by bundle_skb->len.

As skb_len = bundle_skb->len, my patch replaces bundle_skb->len to
skb_len after the bundle_skb was freed.

Fixes: c8334512f3dd1 ("ath10k: add htt TX bundle for sdio")
Signed-off-by: Lv Yunlong <redacted>
Signed-off-by: Kalle Valo <redacted>
Patch applied to ath-next branch of ath.git, thanks.

8392df5d7e0b ath10k: Fix a use after free in ath10k_htc_send_bundle

-- 
https://patchwork.kernel.org/project/linux-wireless/patch/20210329120154.8963-1-lyl2019@mail.ustc.edu.cn/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help