From: Kalle Valo <kvalo@codeaurora.org>
To: Johan Hovold <johan@kernel.org>
Cc: Amitkumar Karwar <amitkarwar@gmail.com>,
Siva Rebbagondla <siva8118@gmail.com>,
linux-wireless@vger.kernel.org, netdev@vger.kernel.org,
linux-kernel@vger.kernel.org, linux-usb@vger.kernel.org,
Johan Hovold <johan@kernel.org>,
syzbot+b563b7f8dbe8223a51e8@syzkaller.appspotmail.com,
stable <stable@vger.kernel.org>,
Siva Rebbagondla <siva.rebbagondla@redpinesignals.com>,
Prameela Rani Garnepudi <prameela.j04cs@gmail.com>,
Amitkumar Karwar <amit.karwar@redpinesignals.com>,
Fariya Fatima <fariyaf@gmail.com>
Subject: Re: [PATCH 1/5] rsi: fix use-after-free on failed probe and unbind
Date: Wed, 18 Dec 2019 18:57:55 +0000 (UTC) [thread overview]
Message-ID: <20191218185755.0D780C4479F@smtp.codeaurora.org> (raw)
In-Reply-To: <20191128172204.26600-2-johan@kernel.org>
Johan Hovold <johan@kernel.org> wrote:
> Make sure to stop both URBs before returning after failed probe as well
> as on disconnect to avoid use-after-free in the completion handler.
>
> Reported-by: syzbot+b563b7f8dbe8223a51e8@syzkaller.appspotmail.com
> Fixes: a4302bff28e2 ("rsi: add bluetooth rx endpoint")
> Fixes: dad0d04fa7ba ("rsi: Add RS9113 wireless driver")
> Cc: stable <stable@vger.kernel.org> # 3.15
> Cc: Siva Rebbagondla <siva.rebbagondla@redpinesignals.com>
> Cc: Prameela Rani Garnepudi <prameela.j04cs@gmail.com>
> Cc: Amitkumar Karwar <amit.karwar@redpinesignals.com>
> Cc: Fariya Fatima <fariyaf@gmail.com>
> Signed-off-by: Johan Hovold <johan@kernel.org>
5 patches applied to wireless-drivers-next.git, thanks.
e93cd35101b6 rsi: fix use-after-free on failed probe and unbind
92aafe77123a rsi: fix use-after-free on probe errors
477682974811 rsi: fix memory leak on failed URB submission
b9b9f9fea218 rsi: fix non-atomic allocation in completion handler
960da557f435 rsi: add missing endpoint sanity checks
--
https://patchwork.kernel.org/patch/11266455/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
next prev parent reply other threads:[~2019-12-18 18:58 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-11-28 17:21 [PATCH 0/5] rsi: fix use-after-free, memleak and sleep-while-atomic Johan Hovold
2019-11-28 17:22 ` [PATCH 1/5] rsi: fix use-after-free on failed probe and unbind Johan Hovold
2019-12-18 18:57 ` Kalle Valo [this message]
2019-11-28 17:22 ` [PATCH 2/5] rsi: fix use-after-free on probe errors Johan Hovold
2019-11-28 17:22 ` [PATCH 3/5] rsi: fix memory leak on failed URB submission Johan Hovold
2019-11-28 17:22 ` [PATCH 4/5] rsi: fix non-atomic allocation in completion handler Johan Hovold
2019-11-28 17:22 ` [PATCH 5/5] rsi: add missing endpoint sanity checks Johan Hovold
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20191218185755.0D780C4479F@smtp.codeaurora.org \
--to=kvalo@codeaurora.org \
--cc=amit.karwar@redpinesignals.com \
--cc=amitkarwar@gmail.com \
--cc=fariyaf@gmail.com \
--cc=johan@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=linux-wireless@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=prameela.j04cs@gmail.com \
--cc=siva.rebbagondla@redpinesignals.com \
--cc=siva8118@gmail.com \
--cc=stable@vger.kernel.org \
--cc=syzbot+b563b7f8dbe8223a51e8@syzkaller.appspotmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.