Received: by 2002:a05:6a10:c7c6:0:0:0:0 with SMTP id h6csp1648572pxy; Mon, 2 Aug 2021 07:03:47 -0700 (PDT) X-Google-Smtp-Source: ABdhPJzTJEG5elP2FfhMQkrhw15IyFmyYWINNgKWG6IjK8oYi6g5NT+ASJpVuiFsy9hiO8C+aoQT X-Received: by 2002:a17:906:f28f:: with SMTP id gu15mr15707235ejb.7.1627913026864; Mon, 02 Aug 2021 07:03:46 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1627913026; cv=none; d=google.com; s=arc-20160816; b=RVaYkG164EWyjCrc8ekNkWsz9QBCE+lNJexa+RoYxRxR3hblurBcZ62QH0f0yiXDw0 0KJ5ZJhjsHFlGN5xYZMHki4i4XbIE4sAhqtJLENBCxPccuiERCrsZcMt4UIn0GPBpi93 C/5P5oFZ4+wrI/cEHeWD3rRQBbYV53wRgDvI8BzFccrAHeDBsTXWQJM4C3NG8oSBAx3E IRB05LW7uQcuovyuS/ho58GP8hrMN0XcE0TmpZJbASbqctOfyDULeu7sqyr9UC/eaHK9 fI3PlLVk1WZ8rvqkH/Bl8Fuk5iwdSKXTejje+JbytA72EBAN6ur4avNRaAsrEWcXsjAi 0wSA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=30g9Ak07lvE9mxsa7egk3VI0ybOyt8BXh+zNBt4ANmI=; b=wecFHsPhzzMGL8AhYAaQHE7Kq0wEBuvAnmjwvX9AeKhE0qOqgdTOP9RZ3mGDsijUII NKNqQnZKheqglr63eyc6BU8EnBIHgcKM0bf8FXJ1VvN4dFHXAiVoLeTRguHM8jlHlI5K B3uu4Safb+mLWPjiStbnTQPdLAgnqoe9E9BoiJj/YKpLSYHoRw/2kIMRkkU42vEmrVSg QX9iuqaabL06LDYyAhohLb/wnUgWOA0Oj+nToU2QouQWhLo9nle18pu6DmTXsF7VyGUU 6s7KMPiFJAqBGEn8M1XK7R/oj84jtmmrBH9NG8Zsp1/RFsIObijHa+yhL61sqW4BBq/j D9Pw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=oIGW4eST; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id v3si9659966edq.144.2021.08.02.07.03.23; Mon, 02 Aug 2021 07:03:46 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=oIGW4eST; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236281AbhHBOCC (ORCPT + 99 others); Mon, 2 Aug 2021 10:02:02 -0400 Received: from mail.kernel.org ([198.145.29.99]:34138 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234381AbhHBNyE (ORCPT ); Mon, 2 Aug 2021 09:54:04 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id C3A0461179; Mon, 2 Aug 2021 13:52:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1627912341; bh=kIzYnuZFMrxLllh/y9GtgzQuBkfdQkXRMCDWVGkflII=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=oIGW4eSTVlHzQiYBG4j59Po3ahu9xLyCz2iX/rGLdBsIFyTPTaxspUt1oDqoJyh03 LdLoDu6PPyR9w/LaFea8JUfN9p42cLaC+8mWkcepdQTEI0nbDEuyAfXQWmlL0IJhI0 PT1Sn2Rh7vKb+r16CWzKX9dqR7bzUPgh49nO7M3E= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Pavel Skripkin , Marc Kleine-Budde Subject: [PATCH 5.10 16/67] can: usb_8dev: fix memory leak Date: Mon, 2 Aug 2021 15:44:39 +0200 Message-Id: <20210802134339.572141213@linuxfoundation.org> X-Mailer: git-send-email 2.32.0 In-Reply-To: <20210802134339.023067817@linuxfoundation.org> References: <20210802134339.023067817@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Pavel Skripkin commit 0e865f0c31928d6a313269ef624907eec55287c4 upstream. In usb_8dev_start() MAX_RX_URBS coherent buffers are allocated and there is nothing, that frees them: 1) In callback function the urb is resubmitted and that's all 2) In disconnect function urbs are simply killed, but URB_FREE_BUFFER is not set (see usb_8dev_start) and this flag cannot be used with coherent buffers. So, all allocated buffers should be freed with usb_free_coherent() explicitly. Side note: This code looks like a copy-paste of other can drivers. The same patch was applied to mcba_usb driver and it works nice with real hardware. There is no change in functionality, only clean-up code for coherent buffers. Fixes: 0024d8ad1639 ("can: usb_8dev: Add support for USB2CAN interface from 8 devices") Link: https://lore.kernel.org/r/d39b458cd425a1cf7f512f340224e6e9563b07bd.1627404470.git.paskripkin@gmail.com Cc: linux-stable Signed-off-by: Pavel Skripkin Signed-off-by: Marc Kleine-Budde Signed-off-by: Greg Kroah-Hartman --- drivers/net/can/usb/usb_8dev.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) --- a/drivers/net/can/usb/usb_8dev.c +++ b/drivers/net/can/usb/usb_8dev.c @@ -137,7 +137,8 @@ struct usb_8dev_priv { u8 *cmd_msg_buffer; struct mutex usb_8dev_cmd_lock; - + void *rxbuf[MAX_RX_URBS]; + dma_addr_t rxbuf_dma[MAX_RX_URBS]; }; /* tx frame */ @@ -733,6 +734,7 @@ static int usb_8dev_start(struct usb_8de for (i = 0; i < MAX_RX_URBS; i++) { struct urb *urb = NULL; u8 *buf; + dma_addr_t buf_dma; /* create a URB, and a buffer for it */ urb = usb_alloc_urb(0, GFP_KERNEL); @@ -742,7 +744,7 @@ static int usb_8dev_start(struct usb_8de } buf = usb_alloc_coherent(priv->udev, RX_BUFFER_SIZE, GFP_KERNEL, - &urb->transfer_dma); + &buf_dma); if (!buf) { netdev_err(netdev, "No memory left for USB buffer\n"); usb_free_urb(urb); @@ -750,6 +752,8 @@ static int usb_8dev_start(struct usb_8de break; } + urb->transfer_dma = buf_dma; + usb_fill_bulk_urb(urb, priv->udev, usb_rcvbulkpipe(priv->udev, USB_8DEV_ENDP_DATA_RX), @@ -767,6 +771,9 @@ static int usb_8dev_start(struct usb_8de break; } + priv->rxbuf[i] = buf; + priv->rxbuf_dma[i] = buf_dma; + /* Drop reference, USB core will take care of freeing it */ usb_free_urb(urb); } @@ -836,6 +843,10 @@ static void unlink_all_urbs(struct usb_8 usb_kill_anchored_urbs(&priv->rx_submitted); + for (i = 0; i < MAX_RX_URBS; ++i) + usb_free_coherent(priv->udev, RX_BUFFER_SIZE, + priv->rxbuf[i], priv->rxbuf_dma[i]); + usb_kill_anchored_urbs(&priv->tx_submitted); atomic_set(&priv->active_tx_urbs, 0);