• Brian Norris's avatar
    mwifiex: fix use-after-free for FW reinit errors · ce8fad9a
    Brian Norris authored
    If we fail to reinit the FW when resetting the device (in the
    synchronous version of mwifiex_init_hw_fw() -> mwifiex_fw_dpc()),
    mwifiex_fw_dpc() will tear down the interface and free up the adapter.
    But we don't actually check for all failure cases of mwifiex_fw_dpc(),
    so some of them fall through and dereference adapter->fw_done with a
    freed adapter, causing a use-after-free bug.
    
    In any case, mwifiex_fw_dpc() will always signal FW completion -- in the
    error OR success case -- so at best, this was repeat work. Let's not do
    it.
    Signed-off-by: default avatarBrian Norris <briannorris@chromium.org>
    Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
    ce8fad9a
main.c 48.5 KB