summaryrefslogtreecommitdiff
path: root/drivers/net/wireless/ath/ath9k/hif_usb.c
diff options
context:
space:
mode:
authorMing Lei <ming.lei@canonical.com>2012-09-13 06:33:28 +0400
committerJohn W. Linville <linville@tuxdriver.com>2012-09-24 22:59:07 +0400
commite962610f8100e1b52973f5a9c855cbc3d1ba04ec (patch)
treed84c4d149bb6624b972e07d6cdf32eaeb1d6ae2d /drivers/net/wireless/ath/ath9k/hif_usb.c
parent7a03414686d8e01c660bf69df22cafcfd2753626 (diff)
downloadlinux-e962610f8100e1b52973f5a9c855cbc3d1ba04ec.tar.xz
wireless: ath9k-htc: fix possible use after free
Inside ath9k_hif_usb_firmware_fail(), the instance of 'struct struct hif_device_usb' may be freed by ath9k_hif_usb_disconnect() after complete(&hif_dev->fw_done); But 'hif_dev' is still accessed after the line code above is executed. This patch fixes the issue by not accessing 'hif_dev' after 'complete(&hif_dev->fw_done)' inside ath9k_hif_usb_firmware_fail(). Cc: ath9k-devel@lists.ath9k.org Cc: "Luis R. Rodriguez" <mcgrof@qca.qualcomm.com> Cc: Jouni Malinen <jouni@qca.qualcomm.com> Cc: Vasanthakumar Thiagarajan <vthiagar@qca.qualcomm.com> Cc: Senthil Balasubramanian <senthilb@qca.qualcomm.com> Cc: "John W. Linville" <linville@tuxdriver.com> Signed-off-by: Ming Lei <ming.lei@canonical.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'drivers/net/wireless/ath/ath9k/hif_usb.c')
-rw-r--r--drivers/net/wireless/ath/ath9k/hif_usb.c5
1 files changed, 3 insertions, 2 deletions
diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c
index ee6e50aebf8d..924c4616c3d9 100644
--- a/drivers/net/wireless/ath/ath9k/hif_usb.c
+++ b/drivers/net/wireless/ath/ath9k/hif_usb.c
@@ -1072,14 +1072,15 @@ static void ath9k_hif_usb_dev_deinit(struct hif_device_usb *hif_dev)
*/
static void ath9k_hif_usb_firmware_fail(struct hif_device_usb *hif_dev)
{
- struct device *parent = hif_dev->udev->dev.parent;
+ struct device *dev = &hif_dev->udev->dev;
+ struct device *parent = dev->parent;
complete(&hif_dev->fw_done);
if (parent)
device_lock(parent);
- device_release_driver(&hif_dev->udev->dev);
+ device_release_driver(dev);
if (parent)
device_unlock(parent);