• Johan Hovold's avatar
    rsi: fix use-after-free on probe errors · 92aafe77
    Johan Hovold authored
    The driver would fail to stop the command timer in most error paths,
    something which specifically could lead to the timer being freed while
    still active on I/O errors during probe.
    
    Fix this by making sure that each function starting the timer also stops
    it in all relevant error paths.
    
    Reported-by: syzbot+1d1597a5aa3679c65b9f@syzkaller.appspotmail.com
    Fixes: b78e91bc ("rsi: Add new firmware loading method")
    Cc: stable <stable@vger.kernel.org>     # 4.12
    Cc: Prameela Rani Garnepudi <prameela.j04cs@gmail.com>
    Cc: Amitkumar Karwar <amit.karwar@redpinesignals.com>
    Signed-off-by: default avatarJohan Hovold <johan@kernel.org>
    Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
    92aafe77
rsi_91x_hal.c 31.3 KB