linux-kernel - Re: [PATCH 1/5] rsi: fix use-after-free on failed probe and unbind

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20191218185755.0D780C4479F@smtp.codeaurora.org>
Date:   Wed, 18 Dec 2019 18:57:55 +0000 (UTC)
From:   Kalle Valo <kvalo@...eaurora.org>
To:     Johan Hovold <johan@...nel.org>
Cc:     Amitkumar Karwar <amitkarwar@...il.com>,
        Siva Rebbagondla <siva8118@...il.com>,
        linux-wireless@...r.kernel.org, netdev@...r.kernel.org,
        linux-kernel@...r.kernel.org, linux-usb@...r.kernel.org,
        Johan Hovold <johan@...nel.org>,
        syzbot+b563b7f8dbe8223a51e8@...kaller.appspotmail.com,
        stable <stable@...r.kernel.org>,
        Siva Rebbagondla <siva.rebbagondla@...pinesignals.com>,
        Prameela Rani Garnepudi <prameela.j04cs@...il.com>,
        Amitkumar Karwar <amit.karwar@...pinesignals.com>,
        Fariya Fatima <fariyaf@...il.com>
Subject: Re: [PATCH 1/5] rsi: fix use-after-free on failed probe and unbind

Johan Hovold <johan@...nel.org> wrote:

> Make sure to stop both URBs before returning after failed probe as well
> as on disconnect to avoid use-after-free in the completion handler.
> 
> Reported-by: syzbot+b563b7f8dbe8223a51e8@...kaller.appspotmail.com
> Fixes: a4302bff28e2 ("rsi: add bluetooth rx endpoint")
> Fixes: dad0d04fa7ba ("rsi: Add RS9113 wireless driver")
> Cc: stable <stable@...r.kernel.org>     # 3.15
> Cc: Siva Rebbagondla <siva.rebbagondla@...pinesignals.com>
> Cc: Prameela Rani Garnepudi <prameela.j04cs@...il.com>
> Cc: Amitkumar Karwar <amit.karwar@...pinesignals.com>
> Cc: Fariya Fatima <fariyaf@...il.com>
> Signed-off-by: Johan Hovold <johan@...nel.org>

5 patches applied to wireless-drivers-next.git, thanks.

e93cd35101b6 rsi: fix use-after-free on failed probe and unbind
92aafe77123a rsi: fix use-after-free on probe errors
477682974811 rsi: fix memory leak on failed URB submission
b9b9f9fea218 rsi: fix non-atomic allocation in completion handler
960da557f435 rsi: add missing endpoint sanity checks

-- 
https://patchwork.kernel.org/patch/11266455/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches