Re: [PATCH] rtl8187: fix use after free on failure path in rtl8187_init_urbs()

2013-09-03 Thread Alexey Khoroshilov
On 02.09.2013 10:34, Hin-Tak Leung wrote: -- On Mon, Sep 2, 2013 05:06 BST Alexey Khoroshilov wrote: On 01.09.2013 10:51, Hin-Tak Leung wrote: -- On Sat, Aug 31, 2013 22:18 BST Alexey Khoroshilov wrote: In case of __dev_alloc_skb()

Re: [PATCH] rtl8187: fix use after free on failure path in rtl8187_init_urbs()

2013-09-03 Thread Alexey Khoroshilov
On 02.09.2013 10:34, Hin-Tak Leung wrote: -- On Mon, Sep 2, 2013 05:06 BST Alexey Khoroshilov wrote: On 01.09.2013 10:51, Hin-Tak Leung wrote: -- On Sat, Aug 31, 2013 22:18 BST Alexey Khoroshilov wrote: In case of __dev_alloc_skb()

Re: [PATCH] rtl8187: fix use after free on failure path in rtl8187_init_urbs()

2013-09-02 Thread Hin-Tak Leung
-- On Mon, Sep 2, 2013 05:06 BST Alexey Khoroshilov wrote: >On 01.09.2013 10:51, Hin-Tak Leung wrote: >> -- >> On Sat, Aug 31, 2013 22:18 BST Alexey Khoroshilov wrote: >> >> In case of __dev_alloc_skb() failure rtl8187_init_urbs() >> calls

Re: [PATCH] rtl8187: fix use after free on failure path in rtl8187_init_urbs()

2013-09-02 Thread Hin-Tak Leung
-- On Mon, Sep 2, 2013 05:06 BST Alexey Khoroshilov wrote: On 01.09.2013 10:51, Hin-Tak Leung wrote: -- On Sat, Aug 31, 2013 22:18 BST Alexey Khoroshilov wrote: In case of __dev_alloc_skb() failure rtl8187_init_urbs() calls

Re: [PATCH] rtl8187: fix use after free on failure path in rtl8187_init_urbs()

2013-09-01 Thread Alexey Khoroshilov
On 01.09.2013 10:51, Hin-Tak Leung wrote: -- On Sat, Aug 31, 2013 22:18 BST Alexey Khoroshilov wrote: In case of __dev_alloc_skb() failure rtl8187_init_urbs() calls usb_free_urb(entry) where 'entry' can points to urb allocated at the previous iteration. That means

Re: [PATCH] rtl8187: fix use after free on failure path in rtl8187_init_urbs()

2013-09-01 Thread Hin-Tak Leung
-- On Sat, Aug 31, 2013 22:18 BST Alexey Khoroshilov wrote: >In case of __dev_alloc_skb() failure rtl8187_init_urbs() >calls usb_free_urb(entry) where 'entry' can points to urb >allocated at the previous iteration. That means refcnt will be >decremented incorrectly and

Re: [PATCH] rtl8187: fix use after free on failure path in rtl8187_init_urbs()

2013-09-01 Thread Hin-Tak Leung
-- On Sat, Aug 31, 2013 22:18 BST Alexey Khoroshilov wrote: In case of __dev_alloc_skb() failure rtl8187_init_urbs() calls usb_free_urb(entry) where 'entry' can points to urb allocated at the previous iteration. That means refcnt will be decremented incorrectly and the

Re: [PATCH] rtl8187: fix use after free on failure path in rtl8187_init_urbs()

2013-09-01 Thread Alexey Khoroshilov
On 01.09.2013 10:51, Hin-Tak Leung wrote: -- On Sat, Aug 31, 2013 22:18 BST Alexey Khoroshilov wrote: In case of __dev_alloc_skb() failure rtl8187_init_urbs() calls usb_free_urb(entry) where 'entry' can points to urb allocated at the previous iteration. That means

[PATCH] rtl8187: fix use after free on failure path in rtl8187_init_urbs()

2013-08-31 Thread Alexey Khoroshilov
In case of __dev_alloc_skb() failure rtl8187_init_urbs() calls usb_free_urb(entry) where 'entry' can points to urb allocated at the previous iteration. That means refcnt will be decremented incorrectly and the urb can be used after memory deallocation. The patch fixes the issue and implements

[PATCH] rtl8187: fix use after free on failure path in rtl8187_init_urbs()

2013-08-31 Thread Alexey Khoroshilov
In case of __dev_alloc_skb() failure rtl8187_init_urbs() calls usb_free_urb(entry) where 'entry' can points to urb allocated at the previous iteration. That means refcnt will be decremented incorrectly and the urb can be used after memory deallocation. The patch fixes the issue and implements