From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.kernel.org ([198.145.29.99]:47958 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726047AbeJKQva (ORCPT ); Thu, 11 Oct 2018 12:51:30 -0400 Date: Thu, 11 Oct 2018 11:25:00 +0200 From: Greg KH To: Amit Pundir Cc: Stable , Carl Huang , Kalle Valo Subject: Re: [PATCH for-4.14.y 2/4] ath10k: fix use-after-free in ath10k_wmi_cmd_send_nowait Message-ID: <20181011092500.GF13455@kroah.com> References: <1539163789-32338-1-git-send-email-amit.pundir@linaro.org> <1539163789-32338-2-git-send-email-amit.pundir@linaro.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1539163789-32338-2-git-send-email-amit.pundir@linaro.org> Sender: stable-owner@vger.kernel.org List-ID: On Wed, Oct 10, 2018 at 02:59:47PM +0530, Amit Pundir wrote: > From: Carl Huang > > commit 9ef0f58ed7b4a55da4a64641d538e0d9e46579ac upstream. > > The skb may be freed in tx completion context before > trace_ath10k_wmi_cmd is called. This can be easily captured when > KASAN(Kernel Address Sanitizer) is enabled. The fix is to move > trace_ath10k_wmi_cmd before the send operation. As the ret has no > meaning in trace_ath10k_wmi_cmd then, so remove this parameter too. > > Signed-off-by: Carl Huang > Tested-by: Brian Norris > Reviewed-by: Brian Norris > Signed-off-by: Kalle Valo > Signed-off-by: Amit Pundir > --- > To be applied on 4.9.y and 4.4.y as well. > Build tested on 4.14.74, 4.9.131 and 4.4.159 for ARCH=arm/arm64 allmodconfig. Applied, thanks. greg k-h