mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-30 22:26:55 +00:00
wifi: rtl8xxxu: Fix the error handling of the probe function
When the driver fails at ieee80211_alloc_hw() at the probe time, the driver will free the 'hw' which is not allocated, causing a bug. The following log can reveal it: [ 15.981294] BUG: KASAN: user-memory-access in mutex_is_locked+0xe/0x40 [ 15.981558] Read of size 8 at addr 0000000000001ab0 by task modprobe/373 [ 15.982583] Call Trace: [ 15.984282] ieee80211_free_hw+0x22/0x390 [ 15.984446] rtl8xxxu_probe+0x3a1/0xab30 [rtl8xxxu] Fix the bug by changing the order of the error handling. Signed-off-by: Zheyu Ma <zheyuma97@gmail.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20220716130444.2950690-1-zheyuma97@gmail.com
This commit is contained in:
parent
69ddcea564
commit
13876f2a08
1 changed files with 11 additions and 10 deletions
|
@ -6658,7 +6658,7 @@ static int rtl8xxxu_probe(struct usb_interface *interface,
|
|||
if (!hw) {
|
||||
ret = -ENOMEM;
|
||||
priv = NULL;
|
||||
goto exit;
|
||||
goto err_put_dev;
|
||||
}
|
||||
|
||||
priv = hw->priv;
|
||||
|
@ -6680,24 +6680,24 @@ static int rtl8xxxu_probe(struct usb_interface *interface,
|
|||
|
||||
ret = rtl8xxxu_parse_usb(priv, interface);
|
||||
if (ret)
|
||||
goto exit;
|
||||
goto err_set_intfdata;
|
||||
|
||||
ret = rtl8xxxu_identify_chip(priv);
|
||||
if (ret) {
|
||||
dev_err(&udev->dev, "Fatal - failed to identify chip\n");
|
||||
goto exit;
|
||||
goto err_set_intfdata;
|
||||
}
|
||||
|
||||
ret = rtl8xxxu_read_efuse(priv);
|
||||
if (ret) {
|
||||
dev_err(&udev->dev, "Fatal - failed to read EFuse\n");
|
||||
goto exit;
|
||||
goto err_set_intfdata;
|
||||
}
|
||||
|
||||
ret = priv->fops->parse_efuse(priv);
|
||||
if (ret) {
|
||||
dev_err(&udev->dev, "Fatal - failed to parse EFuse\n");
|
||||
goto exit;
|
||||
goto err_set_intfdata;
|
||||
}
|
||||
|
||||
rtl8xxxu_print_chipinfo(priv);
|
||||
|
@ -6705,12 +6705,12 @@ static int rtl8xxxu_probe(struct usb_interface *interface,
|
|||
ret = priv->fops->load_firmware(priv);
|
||||
if (ret) {
|
||||
dev_err(&udev->dev, "Fatal - failed to load firmware\n");
|
||||
goto exit;
|
||||
goto err_set_intfdata;
|
||||
}
|
||||
|
||||
ret = rtl8xxxu_init_device(hw);
|
||||
if (ret)
|
||||
goto exit;
|
||||
goto err_set_intfdata;
|
||||
|
||||
hw->wiphy->max_scan_ssids = 1;
|
||||
hw->wiphy->max_scan_ie_len = IEEE80211_MAX_DATA_LEN;
|
||||
|
@ -6760,12 +6760,12 @@ static int rtl8xxxu_probe(struct usb_interface *interface,
|
|||
if (ret) {
|
||||
dev_err(&udev->dev, "%s: Failed to register: %i\n",
|
||||
__func__, ret);
|
||||
goto exit;
|
||||
goto err_set_intfdata;
|
||||
}
|
||||
|
||||
return 0;
|
||||
|
||||
exit:
|
||||
err_set_intfdata:
|
||||
usb_set_intfdata(interface, NULL);
|
||||
|
||||
if (priv) {
|
||||
|
@ -6773,9 +6773,10 @@ static int rtl8xxxu_probe(struct usb_interface *interface,
|
|||
mutex_destroy(&priv->usb_buf_mutex);
|
||||
mutex_destroy(&priv->h2c_mutex);
|
||||
}
|
||||
usb_put_dev(udev);
|
||||
|
||||
ieee80211_free_hw(hw);
|
||||
err_put_dev:
|
||||
usb_put_dev(udev);
|
||||
|
||||
return ret;
|
||||
}
|
||||
|
|
Loading…
Reference in a new issue