lkml.org 
[lkml]   [2020]   [May]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.6 25/49] wimax/i2400m: Fix potential urb refcnt leak
    Date
    From: Xiyu Yang <xiyuyang19@fudan.edu.cn>

    [ Upstream commit 7717cbec172c3554d470023b4020d5781961187e ]

    i2400mu_bus_bm_wait_for_ack() invokes usb_get_urb(), which increases the
    refcount of the "notif_urb".

    When i2400mu_bus_bm_wait_for_ack() returns, local variable "notif_urb"
    becomes invalid, so the refcount should be decreased to keep refcount
    balanced.

    The issue happens in all paths of i2400mu_bus_bm_wait_for_ack(), which
    forget to decrease the refcnt increased by usb_get_urb(), causing a
    refcnt leak.

    Fix this issue by calling usb_put_urb() before the
    i2400mu_bus_bm_wait_for_ack() returns.

    Signed-off-by: Xiyu Yang <xiyuyang19@fudan.edu.cn>
    Signed-off-by: Xin Tan <tanxin.ctf@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/net/wimax/i2400m/usb-fw.c | 1 +
    1 file changed, 1 insertion(+)

    diff --git a/drivers/net/wimax/i2400m/usb-fw.c b/drivers/net/wimax/i2400m/usb-fw.c
    index 529ebca1e9e13..1f7709d24f352 100644
    --- a/drivers/net/wimax/i2400m/usb-fw.c
    +++ b/drivers/net/wimax/i2400m/usb-fw.c
    @@ -354,6 +354,7 @@ ssize_t i2400mu_bus_bm_wait_for_ack(struct i2400m *i2400m,
    usb_autopm_put_interface(i2400mu->usb_iface);
    d_fnend(8, dev, "(i2400m %p ack %p size %zu) = %ld\n",
    i2400m, ack, ack_size, (long) result);
    + usb_put_urb(&notif_urb);
    return result;

    error_exceeded:
    --
    2.20.1


    \
     
     \ /
      Last update: 2020-05-08 14:56    [W:4.387 / U:0.020 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site