From 6f7d0f503d1013f0909fe52075da5d5d500ddca4 Mon Sep 17 00:00:00 2001 From: Felix Fietkau Date: Sun, 29 Sep 2019 22:07:14 +0200 Subject: [PATCH] mt76: fix use-after-free bug in airtime fairness code status.info could point to skb->cb, leading to a use-after-free after the tx status has been reported to mac80211 Signed-off-by: Felix Fietkau --- mt76x02_mac.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/mt76x02_mac.c b/mt76x02_mac.c index d4f37140..41f7c010 100644 --- a/mt76x02_mac.c +++ b/mt76x02_mac.c @@ -612,8 +612,10 @@ void mt76x02_send_tx_status(struct mt76x02_dev *dev, *update = 1; } - if (status.skb) + if (status.skb) { + info = *status.info; mt76_tx_status_skb_done(mdev, status.skb, &list); + } mt76_tx_status_unlock(mdev, &list); if (!status.skb) @@ -632,7 +634,7 @@ void mt76x02_send_tx_status(struct mt76x02_dev *dev, if (!len) goto out; - duration = mt76_calc_tx_airtime(&dev->mt76, status.info, len); + duration = mt76_calc_tx_airtime(&dev->mt76, &info, len); spin_lock_bh(&dev->mt76.cc_lock); dev->tx_airtime += duration;