Date: Fri, 19 Jul 2019 11:39:49 -0400
From: Jarod Wilson <jarod@redhat.com>
To: rhkernel-list@redhat.com
Cc: Jarod Wilson <jarod@redhat.com>
Subject: [RHEL8 PATCH 22/45] iwlwifi: Fix double-free problems in
 iwl_req_fw_callback()

Bugzilla: http://bugzilla.redhat.com/1728992

commit a8627176b0de7ba3f4524f641ddff4abf23ae4e4
Author: Jia-Ju Bai <baijiaju1990@gmail.com>
Date:   Wed May 29 16:39:54 2019 +0300

    iwlwifi: Fix double-free problems in iwl_req_fw_callback()

    In the error handling code of iwl_req_fw_callback(), iwl_dealloc_ucode()
    is called to free data. In iwl_drv_stop(), iwl_dealloc_ucode() is called
    again, which can cause double-free problems.

    To fix this bug, the call to iwl_dealloc_ucode() in
    iwl_req_fw_callback() is deleted.

    This bug is found by a runtime fuzzing tool named FIZZER written by us.

    Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
    Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
    Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

Signed-off-by: Jarod Wilson <jarod@redhat.com>
---
 drivers/net/wireless/intel/iwlwifi/iwl-drv.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
index 852d3cbfc719..fba242284507 100644
--- a/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
+++ b/drivers/net/wireless/intel/iwlwifi/iwl-drv.c
@@ -1597,7 +1597,6 @@ static void iwl_req_fw_callback(const struct firmware *ucode_raw, void *context)
 	goto free;
 
  out_free_fw:
-	iwl_dealloc_ucode(drv);
 	release_firmware(ucode_raw);
  out_unbind:
 	complete(&drv->request_firmware_complete);
-- 
2.20.1