rsi: fix use-after-free on failed probe and unbind
authorJohan Hovold <johan@kernel.org>
Thu, 28 Nov 2019 17:22:00 +0000 (18:22 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 5 Feb 2020 14:43:33 +0000 (14:43 +0000)
commit94b4f57a9c9de6b13c8abf7ba5f5db8fdc149b52
tree5b1377835cd6034a33b775daccfba1ca2baafe9e
parent28fc6259cff958191d3ae8c71a1ce13f2e17a09a
rsi: fix use-after-free on failed probe and unbind

[ Upstream commit e93cd35101b61e4c79149be2cfc927c4b28dc60c ]

Make sure to stop both URBs before returning after failed probe as well
as on disconnect to avoid use-after-free in the completion handler.

Reported-by: syzbot+b563b7f8dbe8223a51e8@syzkaller.appspotmail.com
Fixes: a4302bff28e2 ("rsi: add bluetooth rx endpoint")
Fixes: dad0d04fa7ba ("rsi: Add RS9113 wireless driver")
Cc: stable <stable@vger.kernel.org> # 3.15
Cc: Siva Rebbagondla <siva.rebbagondla@redpinesignals.com>
Cc: Prameela Rani Garnepudi <prameela.j04cs@gmail.com>
Cc: Amitkumar Karwar <amit.karwar@redpinesignals.com>
Cc: Fariya Fatima <fariyaf@gmail.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/net/wireless/rsi/rsi_91x_usb.c