Re: [ath9k-devel] [PATCH -next] wireless: ath9k-htc: fix possible use after free

2012-09-27 Thread John W. Linville
On Thu, Sep 27, 2012 at 12:06:17PM +0800, Ming Lei wrote: > On Thu, Sep 13, 2012 at 10:33 AM, Ming Lei wrote: > > Inside ath9k_hif_usb_firmware_fail(), the instance of > > 'struct struct hif_device_usb' may be freed by > > ath9k_hif_usb_disconnect() after > > > > complete(&hif_dev->fw_done

Re: [ath9k-devel] [PATCH -next] wireless: ath9k-htc: fix possible use after free

2012-09-26 Thread Ming Lei
On Thu, Sep 13, 2012 at 10:33 AM, Ming Lei wrote: > Inside ath9k_hif_usb_firmware_fail(), the instance of > 'struct struct hif_device_usb' may be freed by > ath9k_hif_usb_disconnect() after > > complete(&hif_dev->fw_done); > > But 'hif_dev' is still accessed after the line code > above is

[ath9k-devel] [PATCH -next] wireless: ath9k-htc: fix possible use after free

2012-09-12 Thread Ming Lei
Inside ath9k_hif_usb_firmware_fail(), the instance of 'struct struct hif_device_usb' may be freed by ath9k_hif_usb_disconnect() after complete(&hif_dev->fw_done); But 'hif_dev' is still accessed after the line code above is executed. This patch fixes the issue by not accessing 'hif_dev'