Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Subject: Re: [PATCH] rtl818x: fix potential use after free
To:     Pan Bian <bianpan2016@163.com>,
        Herton Ronaldo Krzesinski <herton@canonical.com>,
        Hin-Tak Leung <htl10@users.sourceforge.net>,
        Kalle Valo <kvalo@codeaurora.org>,
        "David S. Miller" <davem@davemloft.net>
Cc:     linux-wireless@vger.kernel.org, netdev@vger.kernel.org,
        linux-kernel@vger.kernel.org
References: <1543488490-101743-1-git-send-email-bianpan2016@163.com>
From:   Larry Finger <Larry.Finger@lwfinger.net>
Message-ID: <984166c8-bf7a-33f0-f5c5-269ee14f420a@lwfinger.net>
Date:   Thu, 29 Nov 2018 09:09:59 -0600
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101
 Thunderbird/60.3.1
MIME-Version: 1.0
In-Reply-To: <1543488490-101743-1-git-send-email-bianpan2016@163.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On 11/29/18 4:48 AM, Pan Bian wrote:
> entry is released via usb_put_urb just after calling usb_submit_urb.
> However, entry is used if the submission fails, resulting in a use after
> free bug. The patch fixes this.
> 
> Signed-off-by: Pan Bian <bianpan2016@163.com>
> ---
>   drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c | 3 ++-
>   1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c b/drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c
> index cec3778..1a2ea8b 100644
> --- a/drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c
> +++ b/drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c
> @@ -444,12 +444,13 @@ static int rtl8187_init_urbs(struct ieee80211_hw *dev)
>   		skb_queue_tail(&priv->rx_queue, skb);
>   		usb_anchor_urb(entry, &priv->anchored);
>   		ret = usb_submit_urb(entry, GFP_KERNEL);
> -		usb_put_urb(entry);
>   		if (ret) {
>   			skb_unlink(skb, &priv->rx_queue);
>   			usb_unanchor_urb(entry);
> +			usb_put_urb(entry);
>   			goto err;
>   		}
> +		usb_put_urb(entry);
>   	}
>   	return ret;

Good catch.

ACKed-by: Larry Finger <Larry.Finger@lwfinger.net>

Thanks,
Larry