diff options
| author |   Shuah Khan <skhan@linuxfoundation.org> | 2021-04-06 17:02:28 -0600 |
|---|---|---|
| committer |   Kalle Valo <kvalo@codeaurora.org> | 2021-04-22 16:59:56 +0300 |
| commit | eaaf52e4b866f265eb791897d622961293fd48c1 (patch) | |
| tree | 4ad908cc5e7060f08c30e87691dc4fcf0d3520f8 /drivers/net/wireless/ath/ath10k/wmi-tlv.c | |
| parent | ath10k: Fix a use after free in ath10k_htc_send_bundle (diff) | |
| download | linux-eaaf52e4b866f265eb791897d622961293fd48c1.tar.xz linux-eaaf52e4b866f265eb791897d622961293fd48c1.zip | |
ath10k: Fix ath10k_wmi_tlv_op_pull_peer_stats_info() unlock without lock
ath10k_wmi_tlv_op_pull_peer_stats_info() could try to unlock RCU lock
winthout locking it first when peer reason doesn't match the valid
cases for this function.
Add a default case to return without unlocking.
Fixes: 09078368d516 ("ath10k: hold RCU lock when calling ieee80211_find_sta_by_ifaddr()")
Reported-by: Pavel Machek <pavel@ucw.cz>
Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20210406230228.31301-1-skhan@linuxfoundation.org
Diffstat (limited to 'drivers/net/wireless/ath/ath10k/wmi-tlv.c')
| -rw-r--r-- | drivers/net/wireless/ath/ath10k/wmi-tlv.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/net/wireless/ath/ath10k/wmi-tlv.c b/drivers/net/wireless/ath/ath10k/wmi-tlv.c index d97b33f789e4..7efbe03fbca8 100644 --- a/drivers/net/wireless/ath/ath10k/wmi-tlv.c +++ b/drivers/net/wireless/ath/ath10k/wmi-tlv.c @@ -592,6 +592,9 @@ static void ath10k_wmi_event_tdls_peer(struct ath10k *ar, struct sk_buff *skb) GFP_ATOMIC ); break; + default: + kfree(tb); + return; } exit: |