Sergey Matyukevich <sergey.matyukevich.os@xxxxxxxxxxxxx> wrote: > KASAN reported use-after-free error: > > [ 995.220767] BUG: KASAN: use-after-free in qtnf_cmd_send_with_reply+0x169/0x3e0 [qtnfmac] > [ 995.221098] Read of size 2 at addr ffff888213d1ded0 by task kworker/1:1/71 > > The issue in qtnf_cmd_send_with_reply impacts all the commands that do > not need response other then return code. For such commands, consume_skb > is used for response skb and right after that return code in response > skb is accessed. > > Signed-off-by: Sergey Matyukevich <sergey.matyukevich.os@xxxxxxxxxxxxx> 7 patches applied to wireless-drivers-next.git, thanks. 4a33f21cef84 qtnfmac: fix using skb after free dd4c2260dab0 qtnfmac: fix debugfs support for multiple cards 24227a9e956a qtnfmac: fix invalid channel information output 97aef03cb71b qtnfmac: modify Rx descriptors queue setup 46d55fcec163 qtnfmac: send EAPOL frames via control path 239ce8a79778 qtnfmac: handle MIC failure event from firmware 0756e913fc02 qtnfmac: add support for getting/setting transmit power -- https://patchwork.kernel.org/patch/11241691/ https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
