[PATCH] Fix use after free access in at76_disconnect

Markus Elfring Markus.Elfring at web.de
Sun Mar 30 04:53:11 PDT 2025


> The memory pointed to by priv is freed at the end of at76_delete_device
> function (using ieee80211_free_hw). But the code then accesses the udev
> field of the freed object to put the USB device. This may also lead to a
> memory leak of the usb device. Fix this by using udev from interface.

* A corresponding subsystem specification can usually be helpful here.
  https://web.git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/log/drivers/net/wireless/atmel/at76c50x-usb.c?h=next-20250328

* Would you like to append parentheses to any function names?


Regards,
Markus



More information about the linux-arm-kernel mailing list