Commit afbb1947 authored Nov 29, 2018 by Pan Bian Committed by Kalle Valo Dec 13, 2018

rtl818x: fix potential use after free



entry is released via usb_put_urb just after calling usb_submit_urb.
However, entry is used if the submission fails, resulting in a use after
free bug. The patch fixes this.

Signed-off-by: Pan Bian <bianpan2016@163.com>
ACKed-by: Larry Finger <Larry.Finger@lwfinger.net>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

parent 662a7b07

drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -444,12 +444,13 @@ static int rtl8187_init_urbs(struct ieee80211_hw *dev)
		skb_queue_tail(&priv->rx_queue, skb);
		usb_anchor_urb(entry, &priv->anchored);
		ret = usb_submit_urb(entry, GFP_KERNEL);
		usb_put_urb(entry);
		if (ret) {
		skb_unlink(skb, &priv->rx_queue);
		usb_unanchor_urb(entry);
		usb_put_urb(entry);
		goto err;
		}
		usb_put_urb(entry);
		}
		return ret;