]> git.baikalelectronics.ru Git - kernel.git/commit
rtl8187: fix use after free on failure path in rtl8187_init_urbs()
authorAlexey Khoroshilov <khoroshilov@ispras.ru>
Tue, 3 Sep 2013 20:37:17 +0000 (00:37 +0400)
committerJohn W. Linville <linville@tuxdriver.com>
Mon, 9 Sep 2013 18:42:00 +0000 (14:42 -0400)
commit7289b33253e5478fbf61b9672314522b5f3c675a
tree39664637fe66be580f89b08299dfc01d2d822917
parentc4d0cdb9c5032bc4be3f3d3f39b0e1684bd54b27
rtl8187: fix use after free on failure path in rtl8187_init_urbs()

In case of __dev_alloc_skb() failure rtl8187_init_urbs()
calls usb_free_urb(entry) where 'entry' can points to urb
allocated at the previous iteration. That means refcnt will be
decremented incorrectly and the urb can be used after memory
deallocation.

The patch fixes the issue and implements error handling of init_urbs
in rtl8187_start().

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
drivers/net/wireless/rtl818x/rtl8187/dev.c