* [PATCH] wil6210: use after free in wil_netif_rx_any()
@ 2019-09-21 6:01 ` Dan Carpenter
0 siblings, 0 replies; 6+ messages in thread
From: Dan Carpenter @ 2019-09-21 6:01 UTC (permalink / raw)
To: Maya Erez, Dedy Lansky
Cc: Kalle Valo, linux-wireless, wil6210, kernel-janitors
The debug code dereferences "skb" to print "skb->len" so we have to
print the message before we free "skb".
Fixes: f99fe49ff372 ("wil6210: add wil_netif_rx() helper function")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
drivers/net/wireless/ath/wil6210/txrx.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/ath/wil6210/txrx.c b/drivers/net/wireless/ath/wil6210/txrx.c
index cb13652491ad..598c1fba9dac 100644
--- a/drivers/net/wireless/ath/wil6210/txrx.c
+++ b/drivers/net/wireless/ath/wil6210/txrx.c
@@ -1012,11 +1012,11 @@ void wil_netif_rx_any(struct sk_buff *skb, struct net_device *ndev)
skb_orphan(skb);
if (security && (wil->txrx_ops.rx_crypto_check(wil, skb) != 0)) {
+ wil_dbg_txrx(wil, "Rx drop %d bytes\n", skb->len);
dev_kfree_skb(skb);
ndev->stats.rx_dropped++;
stats->rx_replay++;
stats->rx_dropped++;
- wil_dbg_txrx(wil, "Rx drop %d bytes\n", skb->len);
return;
}
--
2.20.1
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH] wil6210: use after free in wil_netif_rx_any()
@ 2019-09-21 6:01 ` Dan Carpenter
0 siblings, 0 replies; 6+ messages in thread
From: Dan Carpenter @ 2019-09-21 6:01 UTC (permalink / raw)
To: Maya Erez, Dedy Lansky
Cc: Kalle Valo, linux-wireless, wil6210, kernel-janitors
The debug code dereferences "skb" to print "skb->len" so we have to
print the message before we free "skb".
Fixes: f99fe49ff372 ("wil6210: add wil_netif_rx() helper function")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
drivers/net/wireless/ath/wil6210/txrx.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/ath/wil6210/txrx.c b/drivers/net/wireless/ath/wil6210/txrx.c
index cb13652491ad..598c1fba9dac 100644
--- a/drivers/net/wireless/ath/wil6210/txrx.c
+++ b/drivers/net/wireless/ath/wil6210/txrx.c
@@ -1012,11 +1012,11 @@ void wil_netif_rx_any(struct sk_buff *skb, struct net_device *ndev)
skb_orphan(skb);
if (security && (wil->txrx_ops.rx_crypto_check(wil, skb) != 0)) {
+ wil_dbg_txrx(wil, "Rx drop %d bytes\n", skb->len);
dev_kfree_skb(skb);
ndev->stats.rx_dropped++;
stats->rx_replay++;
stats->rx_dropped++;
- wil_dbg_txrx(wil, "Rx drop %d bytes\n", skb->len);
return;
}
--
2.20.1
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [PATCH] wil6210: use after free in wil_netif_rx_any()
2019-09-21 6:01 ` Dan Carpenter
@ 2019-09-21 6:31 ` Kalle Valo
-1 siblings, 0 replies; 6+ messages in thread
From: Kalle Valo @ 2019-09-21 6:31 UTC (permalink / raw)
To: Dan Carpenter
Cc: Maya Erez, Dedy Lansky, linux-wireless, wil6210, kernel-janitors
Dan Carpenter <dan.carpenter@oracle.com> writes:
> The debug code dereferences "skb" to print "skb->len" so we have to
> print the message before we free "skb".
>
> Fixes: f99fe49ff372 ("wil6210: add wil_netif_rx() helper function")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
As this is a regression starting from v5.4-rc1, I'll queue this to v5.4.
--
Kalle Valo
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH] wil6210: use after free in wil_netif_rx_any()
@ 2019-09-21 6:31 ` Kalle Valo
0 siblings, 0 replies; 6+ messages in thread
From: Kalle Valo @ 2019-09-21 6:31 UTC (permalink / raw)
To: Dan Carpenter
Cc: Maya Erez, Dedy Lansky, linux-wireless, wil6210, kernel-janitors
Dan Carpenter <dan.carpenter@oracle.com> writes:
> The debug code dereferences "skb" to print "skb->len" so we have to
> print the message before we free "skb".
>
> Fixes: f99fe49ff372 ("wil6210: add wil_netif_rx() helper function")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
As this is a regression starting from v5.4-rc1, I'll queue this to v5.4.
--
Kalle Valo
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] wil6210: use after free in wil_netif_rx_any()
2019-09-21 6:01 ` Dan Carpenter
@ 2019-09-25 6:12 ` Kalle Valo
-1 siblings, 0 replies; 6+ messages in thread
From: Kalle Valo @ 2019-09-25 6:12 UTC (permalink / raw)
To: Dan Carpenter
Cc: Maya Erez, Dedy Lansky, linux-wireless, wil6210, kernel-janitors
Dan Carpenter <dan.carpenter@oracle.com> wrote:
> The debug code dereferences "skb" to print "skb->len" so we have to
> print the message before we free "skb".
>
> Fixes: f99fe49ff372 ("wil6210: add wil_netif_rx() helper function")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Patch applied to wireless-drivers.git, thanks.
2b481835cf4e wil6210: use after free in wil_netif_rx_any()
--
https://patchwork.kernel.org/patch/11155359/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2019-09-25 6:12 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2019-09-21 6:01 [PATCH] wil6210: use after free in wil_netif_rx_any() Dan Carpenter
2019-09-21 6:01 ` Dan Carpenter
2019-09-21 6:31 ` Kalle Valo
2019-09-21 6:31 ` Kalle Valo
2019-09-25 6:12 ` Kalle Valo
2019-09-25 6:12 ` Kalle Valo
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.