]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
rtw88: fix use after free in rtw_hw_scan_update_probe_req()
authorDan Carpenter <dan.carpenter@oracle.com>
Thu, 3 Feb 2022 08:25:32 +0000 (11:25 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 8 Apr 2022 11:58:05 +0000 (13:58 +0200)
commitd9fb80ad781e28b332df8c10b0511e9ca856e55d
treeaa65dd4ed7100f5d2219c125a581205c0fd64a22
parentdaad99303c6d773a13ecf92b91a52c053a6a9831
rtw88: fix use after free in rtw_hw_scan_update_probe_req()

[ Upstream commit a954f29aea5d2cf58feedf83235edf3367229a37 ]

This code needs to use skb_queue_walk_safe() instead of skb_queue_walk()
because it frees the list iterator.

Fixes: d95984b5580d ("rtw88: fix memory overrun and memory leak during hw_scan")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20220203082532.GA25151@kili
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/net/wireless/realtek/rtw88/fw.c