On 9/21/20 9:05 AM, Kalle Valo wrote:
Brooke Basile <[email protected]> wrote:
Calls to usb_kill_anchored_urbs() after usb_kill_urb() on multiprocessor
systems create a race condition in which usb_kill_anchored_urbs() deallocates
the URB before the completer callback is called in usb_kill_urb(), resulting
in a use-after-free.
To fix this, add proper lock protection to usb_kill_urb() calls that can
possibly run concurrently with usb_kill_anchored_urbs().
Reported-by: [email protected]
Link:
https://syzkaller.appspot.com/bug?id=cabffad18eb74197f84871802fd2c5117b61febf
Signed-off-by: Brooke Basile <[email protected]>
Signed-off-by: Kalle Valo <[email protected]>
Patch applied to ath-next branch of ath.git, thanks.
03fb92a432ea ath9k: hif_usb: fix race condition between usb_get_urb() and
usb_kill_anchored_urbs()
Thank you! :)
Best,
Brooke Basile
