• Johan Hovold's avatar
    rsi: fix use-after-free on failed probe and unbind · e93cd351
    Johan Hovold authored
    Make sure to stop both URBs before returning after failed probe as well
    as on disconnect to avoid use-after-free in the completion handler.
    
    Reported-by: syzbot+b563b7f8dbe8223a51e8@syzkaller.appspotmail.com
    Fixes: a4302bff ("rsi: add bluetooth rx endpoint")
    Fixes: dad0d04f ("rsi: Add RS9113 wireless driver")
    Cc: stable <stable@vger.kernel.org>     # 3.15
    Cc: Siva Rebbagondla <siva.rebbagondla@redpinesignals.com>
    Cc: Prameela Rani Garnepudi <prameela.j04cs@gmail.com>
    Cc: Amitkumar Karwar <amit.karwar@redpinesignals.com>
    Cc: Fariya Fatima <fariyaf@gmail.com>
    Signed-off-by: default avatarJohan Hovold <johan@kernel.org>
    Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
    e93cd351
rsi_91x_usb.c 23.8 KB