]> git.itanic.dy.fi Git - linux-stable/commit
rsi: fix use-after-free on probe errors
authorJohan Hovold <johan@kernel.org>
Thu, 28 Nov 2019 17:22:01 +0000 (18:22 +0100)
committerKalle Valo <kvalo@codeaurora.org>
Wed, 18 Dec 2019 18:57:04 +0000 (20:57 +0200)
commit92aafe77123ab478e5f5095878856ab0424910da
treede87c06932dccc0ed79162d37f0323236a7c5f5a
parente93cd35101b61e4c79149be2cfc927c4b28dc60c
rsi: fix use-after-free on probe errors

The driver would fail to stop the command timer in most error paths,
something which specifically could lead to the timer being freed while
still active on I/O errors during probe.

Fix this by making sure that each function starting the timer also stops
it in all relevant error paths.

Reported-by: syzbot+1d1597a5aa3679c65b9f@syzkaller.appspotmail.com
Fixes: b78e91bcfb33 ("rsi: Add new firmware loading method")
Cc: stable <stable@vger.kernel.org> # 4.12
Cc: Prameela Rani Garnepudi <prameela.j04cs@gmail.com>
Cc: Amitkumar Karwar <amit.karwar@redpinesignals.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
drivers/net/wireless/rsi/rsi_91x_hal.c