If ax88172a_unbind() fails, make sure that the return code is less than zero so that cleanup is done properly and avoid UAF. Signed-off-by: George Kennedy <george.kennedy@xxxxxxxxxx> Reported-by: syzbot+4cd84f527bf4a10fc9c1@xxxxxxxxxxxxxxxxxxxxxxxxx --- drivers/net/usb/ax88172a.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/net/usb/ax88172a.c b/drivers/net/usb/ax88172a.c index 4e514f5..fd9faf2 100644 --- a/drivers/net/usb/ax88172a.c +++ b/drivers/net/usb/ax88172a.c @@ -237,6 +237,8 @@ static int ax88172a_bind(struct usbnet *dev, struct usb_interface *intf) free: kfree(priv); + if (ret >= 0) + ret = -EIO; return ret; } -- 1.8.3.1
