Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8e115a07 authored by Jia-Ju Bai's avatar Jia-Ju Bai Committed by Greg Kroah-Hartman
Browse files

iwlwifi: Fix double-free problems in iwl_req_fw_callback() 



[ Upstream commit a8627176b0de7ba3f4524f641ddff4abf23ae4e4 ]

In the error handling code of iwl_req_fw_callback(), iwl_dealloc_ucode()
is called to free data. In iwl_drv_stop(), iwl_dealloc_ucode() is called
again, which can cause double-free problems.

To fix this bug, the call to iwl_dealloc_ucode() in
iwl_req_fw_callback() is deleted.

This bug is found by a runtime fuzzing tool named FIZZER written by us.

Signed-off-by: default avatarJia-Ju Bai <baijiaju1990@gmail.com>
Signed-off-by: default avatarLuca Coelho <luciano.coelho@intel.com>
Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent d4c0f752

drivers/net/wireless/intel/iwlwifi/iwl-drv.c

+0 −1
Original line number Diff line number Diff line
@@ -1547,7 +1547,6 @@ static void iwl_req_fw_callback(const struct firmware *ucode_raw, void *context) 
	goto free;



 out_free_fw:

	iwl_dealloc_ucode(drv);

	release_firmware(ucode_raw);

 out_unbind:

	complete(&drv->request_firmware_complete);