Johan Hovold johan@kernel.org wrote:
Make sure to stop both URBs before returning after failed probe as well as on disconnect to avoid use-after-free in the completion handler.
Reported-by: syzbot+b563b7f8dbe8223a51e8@syzkaller.appspotmail.com Fixes: a4302bff28e2 ("rsi: add bluetooth rx endpoint") Fixes: dad0d04fa7ba ("rsi: Add RS9113 wireless driver") Cc: stable stable@vger.kernel.org # 3.15 Cc: Siva Rebbagondla siva.rebbagondla@redpinesignals.com Cc: Prameela Rani Garnepudi prameela.j04cs@gmail.com Cc: Amitkumar Karwar amit.karwar@redpinesignals.com Cc: Fariya Fatima fariyaf@gmail.com Signed-off-by: Johan Hovold johan@kernel.org
5 patches applied to wireless-drivers-next.git, thanks.
e93cd35101b6 rsi: fix use-after-free on failed probe and unbind 92aafe77123a rsi: fix use-after-free on probe errors 477682974811 rsi: fix memory leak on failed URB submission b9b9f9fea218 rsi: fix non-atomic allocation in completion handler 960da557f435 rsi: add missing endpoint sanity checks