lkml.org 
[lkml]   [2022]   [Jul]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.15 016/230] usbnet: fix memory leak in error case
    Date
    From: Oliver Neukum <oneukum@suse.com>

    commit b55a21b764c1e182014630fa5486d717484ac58f upstream.

    usbnet_write_cmd_async() mixed up which buffers
    need to be freed in which error case.

    v2: add Fixes tag
    v3: fix uninitialized buf pointer

    Fixes: 877bd862f32b8 ("usbnet: introduce usbnet 3 command helpers")
    Signed-off-by: Oliver Neukum <oneukum@suse.com>
    Link: https://lore.kernel.org/r/20220705125351.17309-1-oneukum@suse.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/net/usb/usbnet.c | 17 ++++++++++++-----
    1 file changed, 12 insertions(+), 5 deletions(-)

    --- a/drivers/net/usb/usbnet.c
    +++ b/drivers/net/usb/usbnet.c
    @@ -2135,7 +2135,7 @@ static void usbnet_async_cmd_cb(struct u
    int usbnet_write_cmd_async(struct usbnet *dev, u8 cmd, u8 reqtype,
    u16 value, u16 index, const void *data, u16 size)
    {
    - struct usb_ctrlrequest *req = NULL;
    + struct usb_ctrlrequest *req;
    struct urb *urb;
    int err = -ENOMEM;
    void *buf = NULL;
    @@ -2153,7 +2153,7 @@ int usbnet_write_cmd_async(struct usbnet
    if (!buf) {
    netdev_err(dev->net, "Error allocating buffer"
    " in %s!\n", __func__);
    - goto fail_free;
    + goto fail_free_urb;
    }
    }

    @@ -2177,14 +2177,21 @@ int usbnet_write_cmd_async(struct usbnet
    if (err < 0) {
    netdev_err(dev->net, "Error submitting the control"
    " message: status=%d\n", err);
    - goto fail_free;
    + goto fail_free_all;
    }
    return 0;

    +fail_free_all:
    + kfree(req);
    fail_free_buf:
    kfree(buf);
    -fail_free:
    - kfree(req);
    + /*
    + * avoid a double free
    + * needed because the flag can be set only
    + * after filling the URB
    + */
    + urb->transfer_flags = 0;
    +fail_free_urb:
    usb_free_urb(urb);
    fail:
    return err;

    \
     
     \ /
      Last update: 2022-07-11 11:39    [W:4.221 / U:0.060 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site