linux_dsm_epyc7002/drivers/net/wireless/rtl818x/rtl8187
Alexey Khoroshilov 8a10da2646 rtl8187: fix use after free on failure path in rtl8187_init_urbs()
In case of __dev_alloc_skb() failure rtl8187_init_urbs()
calls usb_free_urb(entry) where 'entry' can points to urb
allocated at the previous iteration. That means refcnt will be
decremented incorrectly and the urb can be used after memory
deallocation.

The patch fixes the issue and implements error handling of init_urbs
in rtl8187_start().

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
2013-09-09 14:42:00 -04:00
..
dev.c rtl8187: fix use after free on failure path in rtl8187_init_urbs() 2013-09-09 14:42:00 -04:00
leds.c rtl8187: ->brightness_set can not sleep 2012-06-08 13:43:57 -04:00
leds.h
Makefile
rfkill.c
rfkill.h
rtl8187.h Update e-mail address for Andrea Merello (resubmit) 2013-08-26 14:10:40 -04:00
rtl8225.c Update e-mail address for Andrea Merello (resubmit) 2013-08-26 14:10:40 -04:00
rtl8225.h Update e-mail address for Andrea Merello (resubmit) 2013-08-26 14:10:40 -04:00