2013-07-17 21:20:53

by Alexey Khoroshilov

[permalink] [raw]
Subject: [PATCH] can: usb_8dev: fix urb leak on failure path in usb_8dev_start()

If usb_8dev_start() fails to submit urb,
it unanchors the urb but forgets to free it.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Alexey Khoroshilov <[email protected]>
---
drivers/net/can/usb/usb_8dev.c | 1 +
1 file changed, 1 insertion(+)

diff --git a/drivers/net/can/usb/usb_8dev.c b/drivers/net/can/usb/usb_8dev.c
index cbd388e..8becd3d 100644
--- a/drivers/net/can/usb/usb_8dev.c
+++ b/drivers/net/can/usb/usb_8dev.c
@@ -779,6 +779,7 @@ static int usb_8dev_start(struct usb_8dev_priv *priv)
usb_unanchor_urb(urb);
usb_free_coherent(priv->udev, RX_BUFFER_SIZE, buf,
urb->transfer_dma);
+ usb_free_urb(urb);
break;
}

--
1.8.1.2


2013-07-19 12:54:54

by Marc Kleine-Budde

[permalink] [raw]
Subject: Re: [PATCH] can: usb_8dev: fix urb leak on failure path in usb_8dev_start()

On 07/17/2013 11:20 PM, Alexey Khoroshilov wrote:
> If usb_8dev_start() fails to submit urb,
> it unanchors the urb but forgets to free it.
>
> Found by Linux Driver Verification project (linuxtesting.org).
>
> Signed-off-by: Alexey Khoroshilov <[email protected]>

Thanks, added to can/fixes-for-3.11

Marc

--
Pengutronix e.K. | Marc Kleine-Budde |
Industrial Linux Solutions | Phone: +49-231-2826-924 |
Vertretung West/Dortmund | Fax: +49-5121-206917-5555 |
Amtsgericht Hildesheim, HRA 2686 | http://www.pengutronix.de |

Attachments:
signature.asc (259.00 B)
OpenPGP digital signature

2013-07-28 08:00:55

by Bernd Krumboeck

[permalink] [raw]
Subject: Re: [PATCH] can: usb_8dev: fix urb leak on failure path in usb_8dev_start()

Thanks!

Added to repository on github: https://github.com/krumboeck/usb2can

regards,
Bernd


Am 2013-07-17 23:20, schrieb Alexey Khoroshilov:
> If usb_8dev_start() fails to submit urb,
> it unanchors the urb but forgets to free it.
>
> Found by Linux Driver Verification project (linuxtesting.org).
>
> Signed-off-by: Alexey Khoroshilov <[email protected]>
> ---
> drivers/net/can/usb/usb_8dev.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/drivers/net/can/usb/usb_8dev.c b/drivers/net/can/usb/usb_8dev.c
> index cbd388e..8becd3d 100644
> --- a/drivers/net/can/usb/usb_8dev.c
> +++ b/drivers/net/can/usb/usb_8dev.c
> @@ -779,6 +779,7 @@ static int usb_8dev_start(struct usb_8dev_priv *priv)
> usb_unanchor_urb(urb);
> usb_free_coherent(priv->udev, RX_BUFFER_SIZE, buf,
> urb->transfer_dma);
> + usb_free_urb(urb);
> break;
> }
>
>