lkml.org 
[lkml]   [2022]   [Jun]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.18 017/339] usb: usbip: fix a refcount leak in stub_probe()
    Date
    From: Hangyu Hua <hbh25y@gmail.com>

    [ Upstream commit 9ec4cbf1cc55d126759051acfe328d489c5d6e60 ]

    usb_get_dev() is called in stub_device_alloc(). When stub_probe() fails
    after that, usb_put_dev() needs to be called to release the reference.

    Fix this by moving usb_put_dev() to sdev_free error path handling.

    Find this by code review.

    Fixes: 3ff67445750a ("usbip: fix error handling in stub_probe()")
    Reviewed-by: Shuah Khan <skhan@linuxfoundation.org>
    Signed-off-by: Hangyu Hua <hbh25y@gmail.com>
    Link: https://lore.kernel.org/r/20220412020257.9767-1-hbh25y@gmail.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/usb/usbip/stub_dev.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    diff --git a/drivers/usb/usbip/stub_dev.c b/drivers/usb/usbip/stub_dev.c
    index d8d3892e5a69..3c6d452e3bf4 100644
    --- a/drivers/usb/usbip/stub_dev.c
    +++ b/drivers/usb/usbip/stub_dev.c
    @@ -393,7 +393,6 @@ static int stub_probe(struct usb_device *udev)

    err_port:
    dev_set_drvdata(&udev->dev, NULL);
    - usb_put_dev(udev);

    /* we already have busid_priv, just lock busid_lock */
    spin_lock(&busid_priv->busid_lock);
    @@ -408,6 +407,7 @@ static int stub_probe(struct usb_device *udev)
    put_busid_priv(busid_priv);

    sdev_free:
    + usb_put_dev(udev);
    stub_device_free(sdev);

    return rc;
    --
    2.35.1


    \
     
     \ /
      Last update: 2022-06-13 15:27    [W:2.863 / U:0.164 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site