Arend Van Spriel <arend.vanspriel@xxxxxxxxxxxx> wrote: > A use-after-free was found using KASAN. In brcmf_p2p_del_if() the virtual > interface is removed using call to brcmf_remove_interface(). After that > the virtual interface instance has been freed and should not be referenced. > Solve this by storing the nl80211 iftype in local variable, which is used > in a couple of places anyway. > > Cc: stable@xxxxxxxxxxxxxxx # 4.10.x, 4.9.x > Reported-by: Daniel J Blueman <daniel@xxxxxxxxx> > Reviewed-by: Hante Meuleman <hante.meuleman@xxxxxxxxxxxx> > Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@xxxxxxxxxxxx> > Reviewed-by: Franky Lin <franky.lin@xxxxxxxxxxxx> > Signed-off-by: Arend van Spriel <arend.vanspriel@xxxxxxxxxxxx> Patch applied to wireless-drivers.git, thanks. d77facb88448 brcmfmac: use local iftype avoiding use-after-free of virtual interface -- https://patchwork.kernel.org/patch/9648553/ Documentation about submitting wireless patches and checking status from patchwork: https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
