]> asedeno.scripts.mit.edu Git - linux.git/commit
rsi: fix use-after-free on failed probe and unbind
authorJohan Hovold <johan@kernel.org>
Thu, 28 Nov 2019 17:22:00 +0000 (18:22 +0100)
committerKalle Valo <kvalo@codeaurora.org>
Wed, 18 Dec 2019 18:57:03 +0000 (20:57 +0200)
commite93cd35101b61e4c79149be2cfc927c4b28dc60c
treee67f9473405ff7ca82a35c18b44e9b4405cb55bf
parent2d52378a0ad0c2c3e8a2572aa883da46ddfaac4e
rsi: fix use-after-free on failed probe and unbind

Make sure to stop both URBs before returning after failed probe as well
as on disconnect to avoid use-after-free in the completion handler.

Reported-by: syzbot+b563b7f8dbe8223a51e8@syzkaller.appspotmail.com
Fixes: a4302bff28e2 ("rsi: add bluetooth rx endpoint")
Fixes: dad0d04fa7ba ("rsi: Add RS9113 wireless driver")
Cc: stable <stable@vger.kernel.org> # 3.15
Cc: Siva Rebbagondla <siva.rebbagondla@redpinesignals.com>
Cc: Prameela Rani Garnepudi <prameela.j04cs@gmail.com>
Cc: Amitkumar Karwar <amit.karwar@redpinesignals.com>
Cc: Fariya Fatima <fariyaf@gmail.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
drivers/net/wireless/rsi/rsi_91x_usb.c