Alexey Khoroshilov 8a10da2646 rtl8187: fix use after free on failure path in rtl8187_init_urbs() ... In case of __dev_alloc_skb() failure rtl8187_init_urbs() calls usb_free_urb(entry) where 'entry' can points to urb allocated at the previous iteration. That means refcnt will be decremented incorrectly and the urb can be used after memory deallocation. The patch fixes the issue and implements error handling of init_urbs in rtl8187_start(). Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru> Signed-off-by: John W. Linville <linville@tuxdriver.com>		2013-09-09 14:42:00 -04:00
..
rtl8180	Update e-mail address for Andrea Merello (resubmit)	2013-08-26 14:10:40 -04:00
rtl8187	rtl8187: fix use after free on failure path in rtl8187_init_urbs()	2013-09-09 14:42:00 -04:00
Kconfig	drivers/net/wireless/rtl818x: remove depends on CONFIG_EXPERIMENTAL	2013-01-22 12:01:35 -08:00
Makefile	rtl818x: move rtl8180 and rtl8187 to separate subdirectories	2010-12-22 13:45:32 -05:00
rtl818x.h	Update e-mail address for Andrea Merello (resubmit)	2013-08-26 14:10:40 -04:00