Re: [PATCH] rtl8187: fix use after free on failure path in rtl8187_init_urbs()

2013-09-03 Thread Alexey Khoroshilov
On 02.09.2013 10:34, Hin-Tak Leung wrote: -- On Mon, Sep 2, 2013 05:06 BST Alexey Khoroshilov wrote: On 01.09.2013 10:51, Hin-Tak Leung wrote: -- On Sat, Aug 31, 2013 22:18 BST Alexey Khoroshilov wrote: In case of __dev_alloc_skb() failu

Re: [PATCH] rtl8187: fix use after free on failure path in rtl8187_init_urbs()

2013-09-01 Thread Hin-Tak Leung
-- On Mon, Sep 2, 2013 05:06 BST Alexey Khoroshilov wrote: >On 01.09.2013 10:51, Hin-Tak Leung wrote: >> -- >> On Sat, Aug 31, 2013 22:18 BST Alexey Khoroshilov wrote: >> >> In case of __dev_alloc_skb() failure rtl8187_init_urbs() >> calls us

Re: [PATCH] rtl8187: fix use after free on failure path in rtl8187_init_urbs()

2013-09-01 Thread Alexey Khoroshilov
On 01.09.2013 10:51, Hin-Tak Leung wrote: -- On Sat, Aug 31, 2013 22:18 BST Alexey Khoroshilov wrote: In case of __dev_alloc_skb() failure rtl8187_init_urbs() calls usb_free_urb(entry) where 'entry' can points to urb allocated at the previous iteration. That means re

Re: [PATCH] rtl8187: fix use after free on failure path in rtl8187_init_urbs()

2013-09-01 Thread Hin-Tak Leung
-- On Sat, Aug 31, 2013 22:18 BST Alexey Khoroshilov wrote: >In case of __dev_alloc_skb() failure rtl8187_init_urbs() >calls usb_free_urb(entry) where 'entry' can points to urb >allocated at the previous iteration. That means refcnt will be >decremented incorrectly and

[PATCH] rtl8187: fix use after free on failure path in rtl8187_init_urbs()

2013-08-31 Thread Alexey Khoroshilov
In case of __dev_alloc_skb() failure rtl8187_init_urbs() calls usb_free_urb(entry) where 'entry' can points to urb allocated at the previous iteration. That means refcnt will be decremented incorrectly and the urb can be used after memory deallocation. The patch fixes the issue and implements erro