Commit 8180bd47 authored Nov 12, 2014 by Mathy Vanhoef Committed by John W. Linville Nov 17, 2014

brcmfmac: kill URB when request timed out



Kill the submitted URB in brcmf_usb_dl_cmd if the request timed out. This
assures the URB is never submitted twice. It also prevents a possible
use-after-free of the URB transfer buffer if a timeout occurs.

Signed-off-by: Mathy Vanhoef <vanhoefm@gmail.com>
Acked-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

parent daad1660

drivers/net/wireless/brcm80211/brcmfmac/usb.c

+4 −2

Original line number	Diff line number	Diff line
		@@ -669,10 +669,12 @@ static int brcmf_usb_dl_cmd(struct brcmf_usbdev_info *devinfo, u8 cmd,
		goto finalize;
		}

		if (!brcmf_usb_ioctl_resp_wait(devinfo))
		if (!brcmf_usb_ioctl_resp_wait(devinfo)) {
		usb_kill_urb(devinfo->ctl_urb);
		ret = -ETIMEDOUT;
		else
		} else {
		memcpy(buffer, tmpbuf, buflen);
		}

		finalize:
		kfree(tmpbuf);