Re: [PATCH] wireless: ath9k: hif_usb: fix race condition between usb_get_urb() and usb_kill_anchored_urbs()

[Brooke Basile]

On 9/21/20 9:05 AM, Kalle Valo wrote:
> Brooke Basile <brookebasile@xxxxxxxxx> wrote:
>
> > Calls to usb_kill_anchored_urbs() after usb_kill_urb() on multiprocessor
> > systems create a race condition in which usb_kill_anchored_urbs() deallocates
> > the URB before the completer callback is called in usb_kill_urb(), resulting
> > in a use-after-free.
> > To fix this, add proper lock protection to usb_kill_urb() calls that can
> > possibly run concurrently with usb_kill_anchored_urbs().
> >
> > Reported-by: syzbot+89bd486af9427a9fc605@xxxxxxxxxxxxxxxxxxxxxxxxx
> > Link: https://syzkaller.appspot.com/bug?id=cabffad18eb74197f84871802fd2c5117b61febf
> > Signed-off-by: Brooke Basile <brookebasile@xxxxxxxxx>
> > Signed-off-by: Kalle Valo <kvalo@xxxxxxxxxxxxxx>
>
> Patch applied to ath-next branch of ath.git, thanks.
>
> 03fb92a432ea ath9k: hif_usb: fix race condition between usb_get_urb() and usb_kill_anchored_urbs()

Thank you! :)

Best,
Brooke Basile