• Miaoqing Pan's avatar
    ath9k: fix tx99 use after free · b729a1ae
    Miaoqing Pan authored
    commit cf8ce1ea upstream.
    
    One scenario that could lead to UAF is two threads writing
    simultaneously to the "tx99" debug file. One of them would
    set the "start" value to true and follow to ath9k_tx99_init().
    Inside the function it would set the sc->tx99_state to true
    after allocating sc->tx99skb. Then, the other thread would
    execute write_file_tx99() and call ath9k_tx99_deinit().
    sc->tx99_state would be freed. After that, the first thread
    would continue inside ath9k_tx99_init() and call
    r = ath9k_tx99_send(sc, sc->tx99_skb, &txctl);
    that would make use of the freed sc->tx99_skb memory.
    Signed-off-by: default avatarMiaoqing Pan <miaoqing@codeaurora.org>
    Signed-off-by: default avatarKalle Valo <kvalo@qca.qualcomm.com>
    Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    b729a1ae
tx99.c 6.8 KB