iwlwifi: mvm: avoid use after free for pmsr request
authorAvraham Stern <avraham.stern@intel.com>
Fri, 31 Jan 2020 13:45:27 +0000 (15:45 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 14 Feb 2020 21:34:09 +0000 (16:34 -0500)
commitec81471a70d100fed872f3f25e069e51afb356c4
tree7ca5a402887dfceca44a939f6e1a06a33780227c
parentb706a498638231b66cee74b20b2696bf95477f1d
iwlwifi: mvm: avoid use after free for pmsr request

commit cc4255eff523f25187bb95561642941de0e57497 upstream.

When a FTM request is aborted, the driver sends the abort command to
the fw and waits for a response. When the response arrives, the driver
calls cfg80211_pmsr_complete() for that request.
However, cfg80211 frees the requested data immediately after sending
the abort command, so this may lead to use after free.

Fix it by clearing the request data in the driver when the abort
command arrives and ignoring the fw notification that will come
afterwards.

Signed-off-by: Avraham Stern <avraham.stern@intel.com>
Fixes: fc36ffda3267 ("iwlwifi: mvm: support FTM initiator")
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/net/wireless/intel/iwlwifi/mvm/ftm-initiator.c