Skip to content
Commit ec81471a authored by Avraham Stern's avatar Avraham Stern Committed by Greg Kroah-Hartman
Browse files

iwlwifi: mvm: avoid use after free for pmsr request

commit cc4255ef

 upstream.

When a FTM request is aborted, the driver sends the abort command to
the fw and waits for a response. When the response arrives, the driver
calls cfg80211_pmsr_complete() for that request.
However, cfg80211 frees the requested data immediately after sending
the abort command, so this may lead to use after free.

Fix it by clearing the request data in the driver when the abort
command arrives and ignoring the fw notification that will come
afterwards.

Signed-off-by: default avatarAvraham Stern <avraham.stern@intel.com>
Fixes: fc36ffda

 ("iwlwifi: mvm: support FTM initiator")
Signed-off-by: default avatarLuca Coelho <luciano.coelho@intel.com>
Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent b706a498
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment