[Home]

Issue of the Implementation # L0124

Brief

drivers/net/wireless/rtl818x/rtl8187/dev.c: use after free on failure path in rtl8187_init_urbs()

Detailed Description

In case of __dev_alloc_skb() failure rtl8187_init_urbs() calls usb_free_urb(entry) where "entry" can points to urb allocated at the previous iteration. That means refcnt will be decremented incorrectly and the urb can be used after memory deallocation.

Component

linux-kernel 3.11

Accepted

https://lkml.org/lkml/2013/8/31/190
commit

Status

Fixed in kernel 3.12-rc1

[Home]