Search Linux Wireless

Re: [PATCH 1/5] ath9k: Fix use-after-free Read in htc_connect_service

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

To: Qiujun Huang <hqjagain@xxxxxxxxx>
Subject: Re: [PATCH 1/5] ath9k: Fix use-after-free Read in htc_connect_service
From: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
Date: Tue, 7 Apr 2020 13:51:55 +0300
Cc: kvalo@xxxxxxxxxxxxxx, ath9k-devel@xxxxxxxxxxxxxxxx, davem@xxxxxxxxxxxxx, linux-wireless@xxxxxxxxxxxxxxx, netdev@xxxxxxxxxxxxxxx, linux-kernel@xxxxxxxxxxxxxxx, anenbupt@xxxxxxxxx, syzkaller-bugs@xxxxxxxxxxxxxxxx
In-reply-to: <20200404041838.10426-2-hqjagain@gmail.com>
References: <20200404041838.10426-1-hqjagain@gmail.com> <20200404041838.10426-2-hqjagain@gmail.com>
User-agent: Mutt/1.9.4 (2018-02-28)

This patch is correct but there are a lot of error paths in
hif_usb_send() which don't free the skb.  Some error paths *do* free
the skb but most don't.  It's really a lot of work to sort through and
fix.

regards,
dan carpenter

References:
- [PATCH 0/5] ath9k: bug fixes
  - From: Qiujun Huang
- [PATCH 1/5] ath9k: Fix use-after-free Read in htc_connect_service
  - From: Qiujun Huang

Prev by Date: [PATCH v2] mac80211: fix race in ieee80211_register_hw()
Next by Date: Re: [PATCH 5/5] ath9k: Fix general protection fault in ath9k_hif_usb_rx_cb
Previous by thread: Re: [PATCH 1/5] ath9k: Fix use-after-free Read in htc_connect_service
Next by thread: [PATCH 3/5] ath9k: Fix use-after-free Write in ath9k_htc_rx_msg
Index(es):
- Date
- Thread

[Index of Archives] [Linux Host AP] [ATH6KL] [Linux Wireless Personal Area Network] [Linux Bluetooth] [Wireless Regulations] [Linux Netdev] [Kernel Newbies] [Linux Kernel] [IDE] [Git] [Netfilter] [Bugtraq] [Yosemite Hiking] [MIPS Linux] [ARM Linux] [Linux RAID]

Powered by Linux