diff options
| author | Mathy Vanhoef <vanhoefm@gmail.com> | 2014-11-12 21:33:34 -0500 |
|---|---|---|
| committer | John W. Linville <linville@tuxdriver.com> | 2014-11-17 15:04:04 -0500 |
| commit | 8180bd47b043507568056f74f69b6a5abea26514 (patch) | |
| tree | e58236b802800f7013139d29ee17d534fc6180c4 | |
| parent | daad1660285a967b5da363e8de264e86b4a496a0 (diff) | |
| download | squashfs-lz4-8180bd47b043507568056f74f69b6a5abea26514.tar.gz | |
brcmfmac: kill URB when request timed out
Kill the submitted URB in brcmf_usb_dl_cmd if the request timed out. This
assures the URB is never submitted twice. It also prevents a possible
use-after-free of the URB transfer buffer if a timeout occurs.
Signed-off-by: Mathy Vanhoef <vanhoefm@gmail.com>
Acked-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
| -rw-r--r-- | drivers/net/wireless/brcm80211/brcmfmac/usb.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/drivers/net/wireless/brcm80211/brcmfmac/usb.c b/drivers/net/wireless/brcm80211/brcmfmac/usb.c index dc135915470d2c..875d1142c8b0f5 100644 --- a/drivers/net/wireless/brcm80211/brcmfmac/usb.c +++ b/drivers/net/wireless/brcm80211/brcmfmac/usb.c @@ -669,10 +669,12 @@ static int brcmf_usb_dl_cmd(struct brcmf_usbdev_info *devinfo, u8 cmd, goto finalize; } - if (!brcmf_usb_ioctl_resp_wait(devinfo)) + if (!brcmf_usb_ioctl_resp_wait(devinfo)) { + usb_kill_urb(devinfo->ctl_urb); ret = -ETIMEDOUT; - else + } else { memcpy(buffer, tmpbuf, buflen); + } finalize: kfree(tmpbuf); |