linux-kernel - Re: [PATCH v5 1/2] ath9k: fix use-after-free in ath9k_hif_usb_rx

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2ee8f6fc-aec1-39a6-e8db-56e5e449ee8e@gmail.com>
Date:   Fri, 10 Jun 2022 16:01:06 +0300
From:   Pavel Skripkin <paskripkin@...il.com>
To:     Hillf Danton <hdanton@...a.com>
Cc:     toke@...e.dk, linux-kernel@...r.kernel.org,
        syzbot+c6dde1f690b60e0b9fbe@...kaller.appspotmail.com
Subject: Re: [PATCH v5 1/2] ath9k: fix use-after-free in ath9k_hif_usb_rx_cb

Hi Hillf,

On 5/22/22 07:15, Hillf Danton wrote:
> 
> In the call chain below
> 
> 	ath9k_hif_usb_firmware_cb()
> 	  ath9k_htc_hw_alloc()
> 	  ath9k_hif_usb_dev_init()
> 	  ret = ath9k_htc_hw_init()
> 	          ath9k_htc_probe_device()
> 		    htc_handle->drv_priv = priv;
> 		    ret = ath9k_htc_wait_for_target(priv);
> 		    if (ret)
> 			goto err_free;
> 	  if (ret)
> 		goto err_htc_hw_init;
> 
> err_free:
> 	ieee80211_free_hw(hw);
> 
> 
> err_htc_hw_init:
> 	ath9k_hif_usb_dev_deinit(hif_dev);
> 	  ath9k_hif_usb_dealloc_urbs()
> err_dev_init:
> 	ath9k_htc_hw_free(hif_dev->htc_handle);
> err_dev_alloc:
> 	release_firmware(fw);
> err_fw:
> 	ath9k_hif_usb_firmware_fail(hif_dev);
> 
> 
> hw should survive deallocating urbs, and changes should be added instead to
> the rollback in ath9k_htc_probe_device() by deferring cleanup of hw to its
> callsite in addition to urbs.
> 

Don't get it, sorry. I am not changing the life time of `hw`, I am just 
deferring htc_handle->drv_priv initialization.




With regards,
Pavel Skripkin

Download attachment "OpenPGP_signature" of type "application/pgp-signature" (841 bytes)