linux/drivers/net
Johan Hovold 94b4f57a9c rsi: fix use-after-free on failed probe and unbind
[ Upstream commit e93cd35101 ]

Make sure to stop both URBs before returning after failed probe as well
as on disconnect to avoid use-after-free in the completion handler.

Reported-by: syzbot+b563b7f8dbe8223a51e8@syzkaller.appspotmail.com
Fixes: a4302bff28 ("rsi: add bluetooth rx endpoint")
Fixes: dad0d04fa7 ("rsi: Add RS9113 wireless driver")
Cc: stable <stable@vger.kernel.org>     # 3.15
Cc: Siva Rebbagondla <siva.rebbagondla@redpinesignals.com>
Cc: Prameela Rani Garnepudi <prameela.j04cs@gmail.com>
Cc: Amitkumar Karwar <amit.karwar@redpinesignals.com>
Cc: Fariya Fatima <fariyaf@gmail.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-02-05 14:43:33 +00:00
..
appletalk
arcnet arcnet: provide a buffer big enough to actually receive packets 2019-10-05 13:09:26 +02:00
bonding bonding: fix active-backup transition after link failure 2020-01-04 19:13:23 +01:00
caif caif-hsi: fix possible deadlock in cfhsi_exit_module() 2019-07-28 08:29:23 +02:00
can can, slip: Protect tty->disc_data in write_wakeup and close with RCU 2020-01-29 16:43:14 +01:00
dsa net: dsa: qca8k: Enable delay for RGMII_ID mode 2020-01-27 14:50:25 +01:00
ethernet drivers/net/b44: Change to non-atomic bit operations on pwol_mask 2020-02-01 09:37:08 +00:00
fddi
fjes fjes: fix missed check in fjes_acpi_add 2019-12-31 16:34:36 +01:00
hamradio 6pack,mkiss: fix possible deadlock 2020-01-04 19:13:27 +01:00
hippi
hyperv hv_netvsc: flag software created hash value 2020-01-27 14:51:21 +01:00
ieee802154 ieee802154: ca8210: prevent memory leak 2019-10-29 09:19:31 +01:00
ipvlan net: ipvlan: Fix ipvlan device tso disabled while NETIF_F_IP_CSUM is set 2019-06-25 11:35:58 +08:00
netdevsim
phy net: phy: don't clear BMCR in genphy_soft_reset 2020-01-27 14:50:34 +01:00
plip
ppp ppp: Fix memory leak in ppp_write 2019-10-05 13:09:29 +02:00
slip can, slip: Protect tty->disc_data in write_wakeup and close with RCU 2020-01-29 16:43:14 +01:00
team team: Add vlan tx offload to hw_enc_features 2019-08-25 10:48:04 +02:00
usb net: usb: lan78xx: Add .ndo_features_check 2020-01-29 16:43:17 +01:00
vmxnet3
wan net: wan: sdla: Fix cast from pointer to integer of different size 2020-02-01 09:37:08 +00:00
wimax wimax/i2400m: fix a memory leak bug 2019-09-10 10:33:48 +01:00
wireless rsi: fix use-after-free on failed probe and unbind 2020-02-05 14:43:33 +00:00
xen-netback net: xen-netback: fix return type of ndo_start_xmit function 2019-11-24 08:19:18 +01:00
dummy.c
eql.c
geneve.c geneve: correctly handle ipv6.disable module parameter 2019-03-10 07:17:17 +01:00
gtp.c gtp: make sure only SOCK_DGRAM UDP sockets are accepted 2020-01-29 16:43:14 +01:00
ifb.c
Kconfig geneve: change NET_UDP_TUNNEL dependency to select 2019-12-05 09:21:10 +01:00
LICENSE.SRC
loopback.c net: loopback: clear skb->tstamp before netif_rx() 2018-11-13 11:08:20 -08:00
macsec.c macsec: let the administrator set UP state even if lowerdev is down 2019-12-01 09:17:03 +01:00
macvlan.c macvlan: use skb_reset_mac_header() in macvlan_queue_xmit() 2020-01-23 08:21:34 +01:00
macvtap.c
Makefile net: Always descend into dsa/ 2019-05-25 18:23:19 +02:00
mdio.c
mii.c
net_failover.c failover: Fix error return code in net_failover_create 2019-11-20 18:46:12 +01:00
netconsole.c
nlmon.c
ntb_netdev.c ntb_netdev: fix sleep time mismatch 2019-12-01 09:17:13 +01:00
rionet.c rapidio/rionet: do not free skb before reading its length 2018-12-05 19:31:59 +01:00
sb1000.c
Space.c
sungem_phy.c
tap.c
thunderbolt.c net: thunderbolt: Unregister ThunderboltIP protocol handler when suspending 2019-06-15 11:54:07 +02:00
tun.c tun: add mutex_unlock() call and napi.skb clearing in tun_get_user() 2020-01-29 16:43:17 +01:00
veth.c
virtio_net.c virtio_net: Account for tx bytes and packets on sending xdp_frames 2019-02-12 19:47:23 +01:00
vrf.c vrf: mark skb for multicast or link-local as enslaved to VRF 2019-12-01 09:17:28 +01:00
vsockmon.c
vxlan.c vxlan: changelink: Fix handling of default remotes 2020-01-27 14:50:07 +01:00
xen-netfront.c xen-netfront: do not use ~0U as error return value for xennet_fill_frags() 2019-10-07 18:57:25 +02:00