Commit 13876f2a authored by Zheyu Ma's avatar Zheyu Ma Committed by Kalle Valo
Browse files

wifi: rtl8xxxu: Fix the error handling of the probe function 



When the driver fails at ieee80211_alloc_hw() at the probe time, the
driver will free the 'hw' which is not allocated, causing a bug.

The following log can reveal it:

[   15.981294] BUG: KASAN: user-memory-access in mutex_is_locked+0xe/0x40
[   15.981558] Read of size 8 at addr 0000000000001ab0 by task modprobe/373
[   15.982583] Call Trace:
[   15.984282]  ieee80211_free_hw+0x22/0x390
[   15.984446]  rtl8xxxu_probe+0x3a1/0xab30 [rtl8xxxu]

Fix the bug by changing the order of the error handling.

Signed-off-by: default avatarZheyu Ma <zheyuma97@gmail.com>
Signed-off-by: default avatarKalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20220716130444.2950690-1-zheyuma97@gmail.com
parent 69ddcea5

drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c

+11 −10
Original line number Diff line number Diff line
@@ -6658,7 +6658,7 @@ static int rtl8xxxu_probe(struct usb_interface *interface, 
	if (!hw) {

		ret = -ENOMEM;

		priv = NULL;

		goto exit;

		goto err_put_dev;

	}



	priv = hw->priv;
@@ -6680,24 +6680,24 @@ static int rtl8xxxu_probe(struct usb_interface *interface, 


	ret = rtl8xxxu_parse_usb(priv, interface);

	if (ret)

		goto exit;

		goto err_set_intfdata;



	ret = rtl8xxxu_identify_chip(priv);

	if (ret) {

		dev_err(&udev->dev, "Fatal - failed to identify chip\n");

		goto exit;

		goto err_set_intfdata;

	}



	ret = rtl8xxxu_read_efuse(priv);

	if (ret) {

		dev_err(&udev->dev, "Fatal - failed to read EFuse\n");

		goto exit;

		goto err_set_intfdata;

	}



	ret = priv->fops->parse_efuse(priv);

	if (ret) {

		dev_err(&udev->dev, "Fatal - failed to parse EFuse\n");

		goto exit;

		goto err_set_intfdata;

	}



	rtl8xxxu_print_chipinfo(priv);
@@ -6705,12 +6705,12 @@ static int rtl8xxxu_probe(struct usb_interface *interface, 
	ret = priv->fops->load_firmware(priv);

	if (ret) {

		dev_err(&udev->dev, "Fatal - failed to load firmware\n");

		goto exit;

		goto err_set_intfdata;

	}



	ret = rtl8xxxu_init_device(hw);

	if (ret)

		goto exit;

		goto err_set_intfdata;



	hw->wiphy->max_scan_ssids = 1;

	hw->wiphy->max_scan_ie_len = IEEE80211_MAX_DATA_LEN;
@@ -6760,12 +6760,12 @@ static int rtl8xxxu_probe(struct usb_interface *interface, 
	if (ret) {

		dev_err(&udev->dev, "%s: Failed to register: %i\n",

			__func__, ret);

		goto exit;

		goto err_set_intfdata;

	}



	return 0;



exit:

err_set_intfdata:

	usb_set_intfdata(interface, NULL);



	if (priv) {
@@ -6773,9 +6773,10 @@ static int rtl8xxxu_probe(struct usb_interface *interface, 
		mutex_destroy(&priv->usb_buf_mutex);

		mutex_destroy(&priv->h2c_mutex);

	}

	usb_put_dev(udev);



	ieee80211_free_hw(hw);

err_put_dev:

	usb_put_dev(udev);



	return ret;

}