| Message ID | 20230315202112.163012-4-pchelkin@ispras.ru (mailing list archive) |
|---|---|
| State | Superseded |
| Delegated to: | Toke Høiland-Jørgensen |
| Headers | show |
| Series | wifi: ath9k: deal with uninit memory | expand |
diff --git a/drivers/net/wireless/ath/ath9k/wmi.c b/drivers/net/wireless/ath/ath9k/wmi.c index 99a91bbaace9..3e0ad4f8f0a0 100644 --- a/drivers/net/wireless/ath/ath9k/wmi.c +++ b/drivers/net/wireless/ath/ath9k/wmi.c @@ -320,8 +320,11 @@ int ath9k_wmi_cmd(struct wmi *wmi, enum wmi_cmd_id cmd_id, unsigned long time_left; int ret = 0; - if (ah->ah_flags & AH_UNPLUGGED) - return 0; + if (ah->ah_flags & AH_UNPLUGGED) { + ath_dbg(common, WMI, "Device unplugged for WMI command: %s\n", + wmi_cmd_to_name(cmd_id)); + return -ENODEV; + } skb = alloc_skb(headroom + cmd_len, GFP_ATOMIC); if (!skb)
Return with an error code in case the USB device has been already unplugged. Otherwise the callers of ath9k_wmi_cmd() are unaware of the fact that cmd_buf and rsp_buf are not initialized or handled properly inside this function. Found by Linux Verification Center (linuxtesting.org) with Syzkaller. Fixes: a3be14b76da1 ("ath9k_htc: Handle device unplug properly") Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru> --- drivers/net/wireless/ath/ath9k/wmi.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)