If ax88172a_unbind() fails, make sure that the return code is
less than zero so that cleanup is done properly and avoid UAF.
Signed-off-by: George Kennedy <george.kenn...@oracle.com>
Reported-by: syzbot+4cd84f527bf4a10fc...@syzkaller.appspotmail.com
---
drivers/net/usb/ax88172a.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/net/usb/ax88172a.c b/drivers/net/usb/ax88172a.c
index 4e514f5..fd9faf2 100644
--- a/drivers/net/usb/ax88172a.c
+++ b/drivers/net/usb/ax88172a.c
@@ -237,6 +237,8 @@ static int ax88172a_bind(struct usbnet *dev, struct
usb_interface *intf)
free:
kfree(priv);
+ if (ret >= 0)
+ ret = -EIO;
return ret;
}
--
1.8.3.1
