Re: [PATCH 1/5] rsi: fix use-after-free on failed probe and unbind
From: Kalle Valo <hidden>
Date: 2019-12-18 18:57:59
Also in:
linux-usb, linux-wireless, lkml, stable
Johan Hovold [off-list ref] wrote:
Make sure to stop both URBs before returning after failed probe as well
as on disconnect to avoid use-after-free in the completion handler.
Reported-by: syzbot+b563b7f8dbe8223a51e8@syzkaller.appspotmail.com
Fixes: a4302bff28e2 ("rsi: add bluetooth rx endpoint")
Fixes: dad0d04fa7ba ("rsi: Add RS9113 wireless driver")
Cc: stable <redacted> # 3.15
Cc: Siva Rebbagondla <redacted>
Cc: Prameela Rani Garnepudi <redacted>
Cc: Amitkumar Karwar <redacted>
Cc: Fariya Fatima <redacted>
Signed-off-by: Johan Hovold <johan@kernel.org>5 patches applied to wireless-drivers-next.git, thanks. e93cd35101b6 rsi: fix use-after-free on failed probe and unbind 92aafe77123a rsi: fix use-after-free on probe errors 477682974811 rsi: fix memory leak on failed URB submission b9b9f9fea218 rsi: fix non-atomic allocation in completion handler 960da557f435 rsi: add missing endpoint sanity checks -- https://patchwork.kernel.org/patch/11266455/ https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches