diff options
| author | Jia-Ju Bai <baijiaju1990@gmail.com> | 2019-05-29 16:39:54 +0300 |
|---|---|---|
| committer | Kalle Valo <kvalo@codeaurora.org> | 2019-06-01 08:04:50 +0300 |
| commit | a8627176b0de7ba3f4524f641ddff4abf23ae4e4 (patch) | |
| tree | e762eb13b0a2e0048644de85829f841ee4e11f75 /drivers/net/wireless/intel/iwlwifi/mvm/rs-fw.c | |
| parent | b17dc0632a17fbfe66b34ee7c24e1cc10cfc503e (diff) | |
| download | linux-a8627176b0de7ba3f4524f641ddff4abf23ae4e4.tar.gz | |
iwlwifi: Fix double-free problems in iwl_req_fw_callback()
In the error handling code of iwl_req_fw_callback(), iwl_dealloc_ucode()
is called to free data. In iwl_drv_stop(), iwl_dealloc_ucode() is called
again, which can cause double-free problems.
To fix this bug, the call to iwl_dealloc_ucode() in
iwl_req_fw_callback() is deleted.
This bug is found by a runtime fuzzing tool named FIZZER written by us.
Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Diffstat (limited to 'drivers/net/wireless/intel/iwlwifi/mvm/rs-fw.c')
0 files changed, 0 insertions, 0 deletions