summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMathy Vanhoef <vanhoefm@gmail.com>2014-11-13 03:33:34 +0100
committerJohn W. Linville <linville@tuxdriver.com>2014-11-17 21:04:04 +0100
commit8180bd47b043507568056f74f69b6a5abea26514 (patch)
treee58236b802800f7013139d29ee17d534fc6180c4
parentath9k: fix regression in bssidmask calculation (diff)
downloadlinux-8180bd47b043507568056f74f69b6a5abea26514.tar.xz
linux-8180bd47b043507568056f74f69b6a5abea26514.zip
brcmfmac: kill URB when request timed out
Kill the submitted URB in brcmf_usb_dl_cmd if the request timed out. This assures the URB is never submitted twice. It also prevents a possible use-after-free of the URB transfer buffer if a timeout occurs. Signed-off-by: Mathy Vanhoef <vanhoefm@gmail.com> Acked-by: Arend van Spriel <arend@broadcom.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
-rw-r--r--drivers/net/wireless/brcm80211/brcmfmac/usb.c6
1 files changed, 4 insertions, 2 deletions
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/usb.c b/drivers/net/wireless/brcm80211/brcmfmac/usb.c
index dc135915470d..875d1142c8b0 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/usb.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/usb.c
@@ -669,10 +669,12 @@ static int brcmf_usb_dl_cmd(struct brcmf_usbdev_info *devinfo, u8 cmd,
goto finalize;
}
- if (!brcmf_usb_ioctl_resp_wait(devinfo))
+ if (!brcmf_usb_ioctl_resp_wait(devinfo)) {
+ usb_kill_urb(devinfo->ctl_urb);
ret = -ETIMEDOUT;
- else
+ } else {
memcpy(buffer, tmpbuf, buflen);
+ }
finalize:
kfree(tmpbuf);