[PATCH] Fix use after free access in at76_disconnect
Markus Elfring
Markus.Elfring at web.de
Sun Mar 30 04:53:11 PDT 2025
> The memory pointed to by priv is freed at the end of at76_delete_device
> function (using ieee80211_free_hw). But the code then accesses the udev
> field of the freed object to put the USB device. This may also lead to a
> memory leak of the usb device. Fix this by using udev from interface.
* A corresponding subsystem specification can usually be helpful here.
https://web.git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/log/drivers/net/wireless/atmel/at76c50x-usb.c?h=next-20250328
* Would you like to append parentheses to any function names?
Regards,
Markus
More information about the linux-arm-kernel
mailing list