iwlwifi: mvm: avoid use after free for pmsr request
authorAvraham Stern <avraham.stern@intel.com>
Fri, 31 Jan 2020 13:45:27 +0000 (15:45 +0200)
committerKalle Valo <kvalo@codeaurora.org>
Mon, 3 Feb 2020 18:09:11 +0000 (20:09 +0200)
commitcc4255eff523f25187bb95561642941de0e57497
tree29fd612356728c3a39771cb869f6da007b14c40d
parent6bd5fa332a8c24c8b9079a70c44240b61858fab8
iwlwifi: mvm: avoid use after free for pmsr request

When a FTM request is aborted, the driver sends the abort command to
the fw and waits for a response. When the response arrives, the driver
calls cfg80211_pmsr_complete() for that request.
However, cfg80211 frees the requested data immediately after sending
the abort command, so this may lead to use after free.

Fix it by clearing the request data in the driver when the abort
command arrives and ignoring the fw notification that will come
afterwards.

Signed-off-by: Avraham Stern <avraham.stern@intel.com>
Fixes: fc36ffda3267 ("iwlwifi: mvm: support FTM initiator")
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
drivers/net/wireless/intel/iwlwifi/mvm/ftm-initiator.c