| Message ID | 20191113110639.9226-2-sergey.matyukevich.os@quantenna.com (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 4a33f21cef84b1b933958c99ed5dac1726214b35 |
| Delegated to: | Kalle Valo |
| Headers | show |
| Series | qtnfmac: misc features and fixes | expand |
Sergey Matyukevich <sergey.matyukevich.os@quantenna.com> wrote: > KASAN reported use-after-free error: > > [ 995.220767] BUG: KASAN: use-after-free in qtnf_cmd_send_with_reply+0x169/0x3e0 [qtnfmac] > [ 995.221098] Read of size 2 at addr ffff888213d1ded0 by task kworker/1:1/71 > > The issue in qtnf_cmd_send_with_reply impacts all the commands that do > not need response other then return code. For such commands, consume_skb > is used for response skb and right after that return code in response > skb is accessed. > > Signed-off-by: Sergey Matyukevich <sergey.matyukevich.os@quantenna.com> 7 patches applied to wireless-drivers-next.git, thanks. 4a33f21cef84 qtnfmac: fix using skb after free dd4c2260dab0 qtnfmac: fix debugfs support for multiple cards 24227a9e956a qtnfmac: fix invalid channel information output 97aef03cb71b qtnfmac: modify Rx descriptors queue setup 46d55fcec163 qtnfmac: send EAPOL frames via control path 239ce8a79778 qtnfmac: handle MIC failure event from firmware 0756e913fc02 qtnfmac: add support for getting/setting transmit power
diff --git a/drivers/net/wireless/quantenna/qtnfmac/commands.c b/drivers/net/wireless/quantenna/qtnfmac/commands.c index dc0c7244b60e..c0c32805fb8d 100644 --- a/drivers/net/wireless/quantenna/qtnfmac/commands.c +++ b/drivers/net/wireless/quantenna/qtnfmac/commands.c @@ -83,6 +83,7 @@ static int qtnf_cmd_send_with_reply(struct qtnf_bus *bus, struct qlink_cmd *cmd; struct qlink_resp *resp = NULL; struct sk_buff *resp_skb = NULL; + int resp_res = 0; u16 cmd_id; u8 mac_id; u8 vif_id; @@ -113,6 +114,7 @@ static int qtnf_cmd_send_with_reply(struct qtnf_bus *bus, } resp = (struct qlink_resp *)resp_skb->data; + resp_res = le16_to_cpu(resp->result); ret = qtnf_cmd_check_reply_header(resp, cmd_id, mac_id, vif_id, const_resp_size); if (ret) @@ -128,8 +130,8 @@ static int qtnf_cmd_send_with_reply(struct qtnf_bus *bus, else consume_skb(resp_skb); - if (!ret && resp) - return qtnf_cmd_resp_result_decode(le16_to_cpu(resp->result)); + if (!ret) + return qtnf_cmd_resp_result_decode(resp_res); pr_warn("VIF%u.%u: cmd 0x%.4X failed: %d\n", mac_id, vif_id, cmd_id, ret);
KASAN reported use-after-free error: [ 995.220767] BUG: KASAN: use-after-free in qtnf_cmd_send_with_reply+0x169/0x3e0 [qtnfmac] [ 995.221098] Read of size 2 at addr ffff888213d1ded0 by task kworker/1:1/71 The issue in qtnf_cmd_send_with_reply impacts all the commands that do not need response other then return code. For such commands, consume_skb is used for response skb and right after that return code in response skb is accessed. Signed-off-by: Sergey Matyukevich <sergey.matyukevich.os@quantenna.com> --- drivers/net/wireless/quantenna/qtnfmac/commands.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)