rtl8187: fix use after free on failure path in rtl8187_probe()
If allocation of io_dmabuf fails, rtl8187_probe() calls usb_put_dev(udev) while usb_get_dev(udev) is not called yet. As a result refcnt is decremented incorrectly and usb_dev can be used after memory deallocation. Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru> Acked-by: Larry Finger <Larry.Finger@lwfinger.net> Signed-off-by: John W. Linville <linville@tuxdriver.com>
This commit is contained in:
parent
6cea5f2173
commit
a31267c308
|
@ -1636,10 +1636,10 @@ static int rtl8187_probe(struct usb_interface *intf,
|
|||
|
||||
err_free_dmabuf:
|
||||
kfree(priv->io_dmabuf);
|
||||
err_free_dev:
|
||||
ieee80211_free_hw(dev);
|
||||
usb_set_intfdata(intf, NULL);
|
||||
usb_put_dev(udev);
|
||||
err_free_dev:
|
||||
ieee80211_free_hw(dev);
|
||||
return err;
|
||||
}
|
||||
|
||||
|
|
Loading…
Reference in a new issue