wireless: ath9k-htc: fix possible use after free
authorMing Lei <ming.lei@canonical.com>
Thu, 13 Sep 2012 02:33:28 +0000 (10:33 +0800)
committerJohn W. Linville <linville@tuxdriver.com>
Mon, 24 Sep 2012 18:59:07 +0000 (14:59 -0400)
commite962610f8100e1b52973f5a9c855cbc3d1ba04ec
treed84c4d149bb6624b972e07d6cdf32eaeb1d6ae2d
parent7a03414686d8e01c660bf69df22cafcfd2753626
wireless: ath9k-htc: fix possible use after free

Inside ath9k_hif_usb_firmware_fail(), the instance of
'struct struct hif_device_usb' may be freed by
ath9k_hif_usb_disconnect() after

complete(&hif_dev->fw_done);

But 'hif_dev' is still accessed after the line code
above is executed.

This patch fixes the issue by not accessing 'hif_dev'
after 'complete(&hif_dev->fw_done)' inside
ath9k_hif_usb_firmware_fail().

Cc: ath9k-devel@lists.ath9k.org
Cc: "Luis R. Rodriguez" <mcgrof@qca.qualcomm.com>
Cc: Jouni Malinen <jouni@qca.qualcomm.com>
Cc: Vasanthakumar Thiagarajan <vthiagar@qca.qualcomm.com>
Cc: Senthil Balasubramanian <senthilb@qca.qualcomm.com>
Cc: "John W. Linville" <linville@tuxdriver.com>
Signed-off-by: Ming Lei <ming.lei@canonical.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
drivers/net/wireless/ath/ath9k/hif_usb.c