]> git.ipfire.org Git - people/arne_f/kernel.git/commit
rsi: fix use-after-free on probe errors
authorJohan Hovold <johan@kernel.org>
Thu, 28 Nov 2019 17:22:01 +0000 (18:22 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sat, 1 Feb 2020 09:32:59 +0000 (09:32 +0000)
commita5403dc796abb3267e0e0bedb11f77a407813d91
treeacfdd7dac572ab39a23931f0962b4da560ae3525
parent18afb7c0ddeef876b21dd2115ef54f17bdd33f44
rsi: fix use-after-free on probe errors

commit 92aafe77123ab478e5f5095878856ab0424910da upstream.

The driver would fail to stop the command timer in most error paths,
something which specifically could lead to the timer being freed while
still active on I/O errors during probe.

Fix this by making sure that each function starting the timer also stops
it in all relevant error paths.

Reported-by: syzbot+1d1597a5aa3679c65b9f@syzkaller.appspotmail.com
Fixes: b78e91bcfb33 ("rsi: Add new firmware loading method")
Cc: stable <stable@vger.kernel.org> # 4.12
Cc: Prameela Rani Garnepudi <prameela.j04cs@gmail.com>
Cc: Amitkumar Karwar <amit.karwar@redpinesignals.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/net/wireless/rsi/rsi_91x_hal.c