From: Dan Carpenter dan.carpenter@oracle.com
commit 9db1aec0c2d72a3b7b115ba56e8dbb5b46855333 upstream.
We dereference "skb" when we assign:
req.pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len); ^^^^^^^^ So this patch just moves the dev_kfree_skb() down a bit to avoid the use after free.
Fixes: 04b8e65922f6 ("mt76: add mac80211 driver for MT7615 PCIe-based chipsets") Signed-off-by: Dan Carpenter dan.carpenter@oracle.com Acked-by: Lorenzo Bianconi lorenzo@kernel.org Signed-off-by: Felix Fietkau nbd@nbd.name Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org
--- drivers/net/wireless/mediatek/mt76/mt7615/mcu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c +++ b/drivers/net/wireless/mediatek/mt76/mt7615/mcu.c @@ -1270,7 +1270,6 @@ int mt7615_mcu_set_bcn(struct mt7615_dev mt7615_mac_write_txwi(dev, (__le32 *)(req.pkt), skb, wcid, NULL, 0, NULL); memcpy(req.pkt + MT_TXD_SIZE, skb->data, skb->len); - dev_kfree_skb(skb);
req.omac_idx = mvif->omac_idx; req.enable = en; @@ -1281,6 +1280,7 @@ int mt7615_mcu_set_bcn(struct mt7615_dev req.pkt_len = cpu_to_le16(MT_TXD_SIZE + skb->len); req.tim_ie_pos = cpu_to_le16(MT_TXD_SIZE + tim_off);
+ dev_kfree_skb(skb); skb = mt7615_mcu_msg_alloc(&req, sizeof(req));
return mt7615_mcu_msg_send(dev, skb, MCU_EXT_CMD_BCN_OFFLOAD,