* [PATCH v2] wifi: at76c50x: fix use after free access in at76_disconnect
@ 2025-03-30 10:31 Abdun Nihaal
2025-03-30 12:01 ` Markus Elfring
0 siblings, 1 reply; 2+ messages in thread
From: Abdun Nihaal @ 2025-03-30 10:31 UTC (permalink / raw)
To: johannes
Cc: nicolas.ferre, alexandre.belloni, claudiu.beznea, erick.archer,
kvalo, miriam.rachel.korenblit, emmanuel.grumbach, abdun.nihaal,
linville, khoroshilov, linux-wireless, linux-arm-kernel,
linux-kernel
The memory pointed to by priv is freed at the end of at76_delete_device
function (using ieee80211_free_hw). But the code then accesses the udev
field of the freed object to put the USB device. This may also lead to a
memory leak of the usb device. Fix this by using udev from interface.
Fixes: 29e20aa6c6af ("at76c50x-usb: fix use after free on failure path in at76_probe()")
Signed-off-by: Abdun Nihaal <abdun.nihaal@gmail.com>
---
V1 -> V2 : Add subsystem name in commit header message
drivers/net/wireless/atmel/at76c50x-usb.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/atmel/at76c50x-usb.c b/drivers/net/wireless/atmel/at76c50x-usb.c
index 504e05ea30f2..97ea7ab0f491 100644
--- a/drivers/net/wireless/atmel/at76c50x-usb.c
+++ b/drivers/net/wireless/atmel/at76c50x-usb.c
@@ -2552,7 +2552,7 @@ static void at76_disconnect(struct usb_interface *interface)
wiphy_info(priv->hw->wiphy, "disconnecting\n");
at76_delete_device(priv);
- usb_put_dev(priv->udev);
+ usb_put_dev(interface_to_usbdev(interface));
dev_info(&interface->dev, "disconnected\n");
}
--
2.47.2
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [PATCH v2] wifi: at76c50x: fix use after free access in at76_disconnect
2025-03-30 10:31 [PATCH v2] wifi: at76c50x: fix use after free access in at76_disconnect Abdun Nihaal
@ 2025-03-30 12:01 ` Markus Elfring
0 siblings, 0 replies; 2+ messages in thread
From: Markus Elfring @ 2025-03-30 12:01 UTC (permalink / raw)
To: Abdun Nihaal, linux-wireless, linux-arm-kernel, Johannes Berg
Cc: LKML, Alexandre Belloni, Alexey Khoroshilov, Claudiu Beznea,
Emmanuel Grumbach, Erick Archer, John W. Linville, Kalle Valo,
Miri Korenblit, Nicolas Ferre
> The memory pointed to by priv is freed at the end of at76_delete_device
> function (using ieee80211_free_hw). But the code then accesses the udev
> field of the freed object to put the USB device. This may also lead to a
> memory leak of the usb device. Fix this by using udev from interface.
Would you like to append parentheses to any function names?
Regards,
Markus
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2025-03-30 12:02 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2025-03-30 10:31 [PATCH v2] wifi: at76c50x: fix use after free access in at76_disconnect Abdun Nihaal
2025-03-30 12:01 ` Markus Elfring
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®