summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMathy Vanhoef <vanhoefm@gmail.com>2014-11-12 21:33:34 -0500
committerJohn W. Linville <linville@tuxdriver.com>2014-11-17 15:04:04 -0500
commit8180bd47b043507568056f74f69b6a5abea26514 (patch)
treee58236b802800f7013139d29ee17d534fc6180c4
parentdaad1660285a967b5da363e8de264e86b4a496a0 (diff)
downloadop-kernel-dev-8180bd47b043507568056f74f69b6a5abea26514.zip
op-kernel-dev-8180bd47b043507568056f74f69b6a5abea26514.tar.gz
brcmfmac: kill URB when request timed out
Kill the submitted URB in brcmf_usb_dl_cmd if the request timed out. This assures the URB is never submitted twice. It also prevents a possible use-after-free of the URB transfer buffer if a timeout occurs. Signed-off-by: Mathy Vanhoef <vanhoefm@gmail.com> Acked-by: Arend van Spriel <arend@broadcom.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
-rw-r--r--drivers/net/wireless/brcm80211/brcmfmac/usb.c6
1 files changed, 4 insertions, 2 deletions
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/usb.c b/drivers/net/wireless/brcm80211/brcmfmac/usb.c
index dc13591..875d114 100644
--- a/drivers/net/wireless/brcm80211/brcmfmac/usb.c
+++ b/drivers/net/wireless/brcm80211/brcmfmac/usb.c
@@ -669,10 +669,12 @@ static int brcmf_usb_dl_cmd(struct brcmf_usbdev_info *devinfo, u8 cmd,
goto finalize;
}
- if (!brcmf_usb_ioctl_resp_wait(devinfo))
+ if (!brcmf_usb_ioctl_resp_wait(devinfo)) {
+ usb_kill_urb(devinfo->ctl_urb);
ret = -ETIMEDOUT;
- else
+ } else {
memcpy(buffer, tmpbuf, buflen);
+ }
finalize:
kfree(tmpbuf);
OpenPOWER on IntegriCloud