linux/drivers
Alexey Khoroshilov 8a10da2646 rtl8187: fix use after free on failure path in rtl8187_init_urbs()
In case of __dev_alloc_skb() failure rtl8187_init_urbs()
calls usb_free_urb(entry) where 'entry' can points to urb
allocated at the previous iteration. That means refcnt will be
decremented incorrectly and the urb can be used after memory
deallocation.

The patch fixes the issue and implements error handling of init_urbs
in rtl8187_start().

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
2013-09-09 14:42:00 -04:00
..
accessibility
acpi Merge branch 'i2c/for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux 2013-09-05 09:31:03 -07:00
amba
ata Merge branch 'for-3.12' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/libata 2013-09-03 18:19:53 -07:00
atm atm: he: print MAC via %pM 2013-09-04 14:41:55 -04:00
auxdisplay
base Merge branch 'next' of git://git.kernel.org/pub/scm/virt/kvm/kvm 2013-09-04 18:15:06 -07:00
bcma bcma: add bcma_core_pci_power_save() 2013-08-26 14:09:03 -04:00
block Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial 2013-09-06 09:36:28 -07:00
bluetooth Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next 2013-08-22 14:27:31 -04:00
bus ARM: SoC platform changes for 3.12 2013-09-06 13:30:06 -07:00
cdrom
char Merge git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 2013-09-07 14:31:18 -07:00
clk ARM: SoC platform changes for 3.12 2013-09-06 13:30:06 -07:00
clocksource ARM: SoC board updates for 3.12 2013-09-06 13:34:43 -07:00
connector
cpufreq ACPI and power management updates for 3.12-rc1 2013-09-03 15:59:39 -07:00
cpuidle cpuidle: coupled: fix race condition between pokes and safe state 2013-08-29 22:15:34 +02:00
crypto Merge git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux 2013-09-07 12:53:35 +10:00
dca
devfreq devfreq: convert devfreq_class to use dev_groups 2013-08-19 21:22:34 -07:00
dio
dma Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2013-09-05 08:50:26 -07:00
edac Merge git://git.kernel.org/pub/scm/linux/kernel/git/cmetcalf/linux-tile 2013-09-06 11:14:33 -07:00
eisa
extcon Driver core patches for 3.12-rc1 2013-09-03 11:37:15 -07:00
firewire
firmware Big part of this is the addition of compression to the 2013-09-03 21:14:06 -07:00
fmc
gpio This is the bulk of GPIO changes for the v3.12 series: 2013-09-07 10:53:00 -07:00
gpu Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial 2013-09-06 09:36:28 -07:00
hid Revert "Input: introduce BTN/ABS bits for drums and guitars" 2013-09-07 09:48:41 -07:00
hsi
hv Drivers: hv: vmbus: Do not attempt to negoatiate a new version prematurely 2013-08-30 12:08:04 -07:00
hwmon Merge branch 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging 2013-09-07 10:54:19 -07:00
hwspinlock
i2c i2c: rcar: add rcar-H2 support 2013-09-04 11:49:16 +01:00
ide ide: sgiioc4: Staticize ioc4_ide_attach_one() 2013-09-05 15:21:30 -04:00
idle
iio staging tree merge for 3.12-rc1 2013-09-03 11:37:57 -07:00
infiniband Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial 2013-09-06 09:36:28 -07:00
input Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input 2013-09-07 10:38:46 -07:00
iommu ARM: tegra: cleanups for 3.12 2013-08-20 16:10:28 -07:00
ipack
irqchip ARM: SoC cleanups for 3.12 2013-09-06 13:21:16 -07:00
isdn Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next 2013-09-05 14:54:29 -07:00
leds ARM: SoC board updates for 3.12 2013-09-06 13:34:43 -07:00
lguest
macintosh macintosh/ams: Replace strict_strtoul() with kstrtoul() 2013-08-14 14:57:43 +10:00
mailbox
md SCSI misc on 20130903 2013-09-03 15:48:06 -07:00
media Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc 2013-09-06 10:49:42 -07:00
memory ARM: SoC platform changes for 3.12 2013-09-06 13:30:06 -07:00
memstick
message
mfd ARM: SoC low-priority fixes for 3.12 2013-09-06 13:17:02 -07:00
misc Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2013-09-05 08:50:26 -07:00
mmc ARM: SoC board updates for 3.12 2013-09-06 13:34:43 -07:00
mtd mtd: mpc5121_nfc: cleanup clock API use 2013-08-23 23:07:46 +02:00
net rtl8187: fix use after free on failure path in rtl8187_init_urbs() 2013-09-09 14:42:00 -04:00
nfc NFC: pn544: i2c: Add firmware download implementation for pn544 2013-08-14 01:13:35 +02:00
ntb
nubus
of ARM: SoC platform changes for 3.12 2013-09-06 13:30:06 -07:00
oprofile oprofile: get rid of pointless forward declarations of struct super_block 2013-09-03 22:52:48 -04:00
parisc PCI changes for the v3.12 merge window: 2013-09-03 16:24:35 -07:00
parport drivers: parport: Kconfig: exclude h8300 for PARPORT_PC 2013-08-30 12:08:04 -07:00
pci ARM: SoC platform changes for 3.12 2013-09-06 13:30:06 -07:00
pcmcia
pinctrl PTR_RET() is a weird name, and led to some confusing usage. We ended 2013-09-04 17:31:11 -07:00
platform PTR_RET() is a weird name, and led to some confusing usage. We ended 2013-09-04 17:31:11 -07:00
pnp Merge branch 'pnp' 2013-08-27 01:41:35 +02:00
power treewide: Fix typo in printk 2013-08-20 12:44:03 +02:00
pps PPS: convert class code to use dev_groups 2013-08-19 21:22:34 -07:00
ps3
ptp
pwm ARM: SoC cleanups for 3.12 2013-09-06 13:21:16 -07:00
rapidio
regulator PTR_RET() is a weird name, and led to some confusing usage. We ended 2013-09-04 17:31:11 -07:00
remoteproc
reset
rpmsg
rtc PTR_RET() is a weird name, and led to some confusing usage. We ended 2013-09-04 17:31:11 -07:00
s390 SCSI misc on 20130903 2013-09-03 15:48:06 -07:00
sbus
scsi Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial 2013-09-06 09:36:28 -07:00
sfi
sh
sn
spi ARM: SoC DT updates for 3.12 2013-09-06 13:26:27 -07:00
ssb
staging Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next 2013-09-05 14:54:29 -07:00
target target: Fix se_cmd->state_list leak regression during WRITE failure 2013-08-31 15:19:12 -07:00
tc
thermal
tty Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input 2013-09-07 10:38:46 -07:00
uio Driver core patches for 3.12-rc1 2013-09-03 11:37:15 -07:00
usb Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc 2013-09-06 10:49:42 -07:00
uwb uwb: Staticize local symbols 2013-08-19 17:08:16 -07:00
vfio
vhost vhost_net: correctly limit the max pending buffers 2013-09-03 22:46:58 -04:00
video ARM: SoC board updates for 3.12 2013-09-06 13:34:43 -07:00
virt
virtio
vlynq
vme vme: vme_ca91cx42.c: fix to pass correct device identity to free_irq() 2013-08-27 21:49:26 -07:00
w1 w1: slaves: w1_ds2781: convert to use w1_family_ops.groups 2013-08-22 11:05:44 -07:00
watchdog
xen Features: 2013-09-04 17:45:39 -07:00
zorro
Kconfig
Makefile