Commit a8627176 authored by Jia-Ju Bai's avatar Jia-Ju Bai Committed by Kalle Valo

iwlwifi: Fix double-free problems in iwl_req_fw_callback()

In the error handling code of iwl_req_fw_callback(), iwl_dealloc_ucode()
is called to free data. In iwl_drv_stop(), iwl_dealloc_ucode() is called
again, which can cause double-free problems.

To fix this bug, the call to iwl_dealloc_ucode() in
iwl_req_fw_callback() is deleted.

This bug is found by a runtime fuzzing tool named FIZZER written by us.
Signed-off-by: default avatarJia-Ju Bai <baijiaju1990@gmail.com>
Signed-off-by: default avatarLuca Coelho <luciano.coelho@intel.com>
Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
parent b17dc063
...@@ -1597,7 +1597,6 @@ static void iwl_req_fw_callback(const struct firmware *ucode_raw, void *context) ...@@ -1597,7 +1597,6 @@ static void iwl_req_fw_callback(const struct firmware *ucode_raw, void *context)
goto free; goto free;
out_free_fw: out_free_fw:
iwl_dealloc_ucode(drv);
release_firmware(ucode_raw); release_firmware(ucode_raw);
out_unbind: out_unbind:
complete(&drv->request_firmware_complete); complete(&drv->request_firmware_complete);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment