diff options
| author | Carl Huang | 2018-03-05 07:44:02 +0100 |
|---|---|---|
| committer | Kalle Valo | 2018-03-26 17:13:03 +0200 |
| commit | 9ef0f58ed7b4a55da4a64641d538e0d9e46579ac (patch) | |
| tree | c2591ea97d34c1a197ff2826c1a9df0e4d25c0e9 /drivers/net/wireless/ath/ath10k/wmi.c | |
| parent | wcn36xx: reduce verbosity of drivers messages (diff) | |
| download | kernel-qcow2-linux-9ef0f58ed7b4a55da4a64641d538e0d9e46579ac.tar.gz kernel-qcow2-linux-9ef0f58ed7b4a55da4a64641d538e0d9e46579ac.tar.xz kernel-qcow2-linux-9ef0f58ed7b4a55da4a64641d538e0d9e46579ac.zip | |
ath10k: fix use-after-free in ath10k_wmi_cmd_send_nowait
The skb may be freed in tx completion context before
trace_ath10k_wmi_cmd is called. This can be easily captured when
KASAN(Kernel Address Sanitizer) is enabled. The fix is to move
trace_ath10k_wmi_cmd before the send operation. As the ret has no
meaning in trace_ath10k_wmi_cmd then, so remove this parameter too.
Signed-off-by: Carl Huang <cjhuang@codeaurora.org>
Tested-by: Brian Norris <briannorris@chromium.org>
Reviewed-by: Brian Norris <briannorris@chromium.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Diffstat (limited to 'drivers/net/wireless/ath/ath10k/wmi.c')
| -rw-r--r-- | drivers/net/wireless/ath/ath10k/wmi.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c index 77c6bc671f32..9649bb752bbd 100644 --- a/drivers/net/wireless/ath/ath10k/wmi.c +++ b/drivers/net/wireless/ath/ath10k/wmi.c @@ -1747,8 +1747,8 @@ int ath10k_wmi_cmd_send_nowait(struct ath10k *ar, struct sk_buff *skb, cmd_hdr->cmd_id = __cpu_to_le32(cmd); memset(skb_cb, 0, sizeof(*skb_cb)); + trace_ath10k_wmi_cmd(ar, cmd_id, skb->data, skb->len); ret = ath10k_htc_send(&ar->htc, ar->wmi.eid, skb); - trace_ath10k_wmi_cmd(ar, cmd_id, skb->data, skb->len, ret); if (ret) goto err_pull; |