| Message ID | 20220208114728.e6b514cf4c85.Iffb575ca2a623d7859b542c33b2a507d01554251@changeid |
|---|---|
| State | New |
| Headers | show |
| Series | iwlwifi: fix use-after-free | expand |
Johannes Berg <johannes@sipsolutions.net> wrote: > From: Johannes Berg <johannes.berg@intel.com> > > If no firmware was present at all (or, presumably, all of the > firmware files failed to parse), we end up unbinding by calling > device_release_driver(), which calls remove(), which then in > iwlwifi calls iwl_drv_stop(), freeing the 'drv' struct. However > the new code I added will still erroneously access it after it > was freed. > > Set 'failure=false' in this case to avoid the access, all data > was already freed anyway. > > Cc: stable@vger.kernel.org > Reported-by: Stefan Agner <stefan@agner.ch> > Reported-by: Wolfgang Walter <linux@stwm.de> > Reported-by: Jason Self <jason@bluehome.net> > Reported-by: Dominik Behr <dominik@dominikbehr.com> > Reported-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com> > Fixes: ab07506b0454 ("iwlwifi: fix leaks/bad data after failed firmware load") > Signed-off-by: Johannes Berg <johannes.berg@intel.com> Patch applied to wireless.git, thanks. bea2662e7818 iwlwifi: fix use-after-free
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c index 83e3b731ad29..6651e78b39ec 100644 --- a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c +++ b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c @@ -1707,6 +1707,8 @@ static void iwl_req_fw_callback(const struct firmware *ucode_raw, void *context) out_unbind: complete(&drv->request_firmware_complete); device_release_driver(drv->trans->dev); + /* drv has just been freed by the release */ + failure = false; free: if (failure) iwl_dealloc_ucode(drv);