Re: [ath9k-devel] [PATCH -next] wireless: ath9k-htc: fix possible use after free

2012-09-27 Thread John W. Linville
On Thu, Sep 27, 2012 at 12:06:17PM +0800, Ming Lei wrote: On Thu, Sep 13, 2012 at 10:33 AM, Ming Lei ming@canonical.com wrote: Inside ath9k_hif_usb_firmware_fail(), the instance of 'struct struct hif_device_usb' may be freed by ath9k_hif_usb_disconnect() after

Re: [ath9k-devel] [PATCH -next] wireless: ath9k-htc: fix possible use after free

2012-09-26 Thread Ming Lei
On Thu, Sep 13, 2012 at 10:33 AM, Ming Lei ming@canonical.com wrote: Inside ath9k_hif_usb_firmware_fail(), the instance of 'struct struct hif_device_usb' may be freed by ath9k_hif_usb_disconnect() after complete(hif_dev-fw_done); But 'hif_dev' is still accessed after the line

[ath9k-devel] [PATCH -next] wireless: ath9k-htc: fix possible use after free

2012-09-12 Thread Ming Lei
Inside ath9k_hif_usb_firmware_fail(), the instance of 'struct struct hif_device_usb' may be freed by ath9k_hif_usb_disconnect() after complete(hif_dev-fw_done); But 'hif_dev' is still accessed after the line code above is executed. This patch fixes the issue by not accessing 'hif_dev'