diff options
| author | Jia-Ju Bai <baijiaju1990@gmail.com> | 2019-05-29 16:39:54 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2019-07-21 09:04:20 +0200 |
| commit | 461117876d9087cc018328f6636e4ae82b58b508 (patch) | |
| tree | 8a89bd7f0cb2dafd0975f2ea424abfce608ac502 | |
| parent | d50f6b58d7ad30ad8e96c0bbc3e5ecfe9b91ba77 (diff) | |
| download | linux-stable-461117876d9087cc018328f6636e4ae82b58b508.tar.gz linux-stable-461117876d9087cc018328f6636e4ae82b58b508.tar.bz2 linux-stable-461117876d9087cc018328f6636e4ae82b58b508.zip | |
iwlwifi: Fix double-free problems in iwl_req_fw_callback()
[ Upstream commit a8627176b0de7ba3f4524f641ddff4abf23ae4e4 ]
In the error handling code of iwl_req_fw_callback(), iwl_dealloc_ucode()
is called to free data. In iwl_drv_stop(), iwl_dealloc_ucode() is called
again, which can cause double-free problems.
To fix this bug, the call to iwl_dealloc_ucode() in
iwl_req_fw_callback() is deleted.
This bug is found by a runtime fuzzing tool named FIZZER written by us.
Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
| -rw-r--r-- | drivers/net/wireless/intel/iwlwifi/iwl-drv.c | 1 |
1 files changed, 0 insertions, 1 deletions
diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c index 99676d6c4713..6c10b8c4ddbe 100644 --- a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c +++ b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c @@ -1509,7 +1509,6 @@ static void iwl_req_fw_callback(const struct firmware *ucode_raw, void *context) goto free; out_free_fw: - iwl_dealloc_ucode(drv); release_firmware(ucode_raw); out_unbind: complete(&drv->request_firmware_complete); |