mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-23 17:30:02 +00:00
at76c50x-usb: fix use after free on failure path in at76_probe()
After commit 174beab7d4
("at76c50x-usb: Don't perform DMA from stack memory")
at76_delete_device() and usb_put_dev() are called both
if at76_init_new_device() fails in at76_probe().
But at76_delete_device() does usb_put_dev(priv->dev) itself
that means double usb_put_dev().
The patch avoids the problem by moving usb_put_dev() from
at76_delete_device() to at76_disconnect().
Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
This commit is contained in:
parent
e5cd6cee46
commit
29e20aa6c6
1 changed files with 1 additions and 2 deletions
|
@ -2423,8 +2423,6 @@ static void at76_delete_device(struct at76_priv *priv)
|
|||
|
||||
kfree_skb(priv->rx_skb);
|
||||
|
||||
usb_put_dev(priv->udev);
|
||||
|
||||
at76_dbg(DBG_PROC_ENTRY, "%s: before freeing priv/ieee80211_hw",
|
||||
__func__);
|
||||
ieee80211_free_hw(priv->hw);
|
||||
|
@ -2558,6 +2556,7 @@ static void at76_disconnect(struct usb_interface *interface)
|
|||
|
||||
wiphy_info(priv->hw->wiphy, "disconnecting\n");
|
||||
at76_delete_device(priv);
|
||||
usb_put_dev(priv->udev);
|
||||
dev_info(&interface->dev, "disconnected\n");
|
||||
}
|
||||
|
||||
|
|
Loading…
Reference in a new issue