Received: by 2002:ad5:4acb:0:0:0:0:0 with SMTP id n11csp3163713imw; Mon, 11 Jul 2022 03:17:19 -0700 (PDT) X-Google-Smtp-Source: AGRyM1s/vj15G/ASszvGZAnzMNCJU9O6sX93xSLmfjP1A1treAv7rK3GAv1Ig6izr7f2zAZMXT3J X-Received: by 2002:a05:6402:3705:b0:43a:214b:5f40 with SMTP id ek5-20020a056402370500b0043a214b5f40mr23211609edb.83.1657534639416; Mon, 11 Jul 2022 03:17:19 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1657534639; cv=none; d=google.com; s=arc-20160816; b=y3hXZNGIwwpQTL918ES0/z0TTwxlzdMBat8knDElK+QseuHl1e/x+jrEUeNA067XzM Z7kRH1+FYUy9mt0JtMsOH99ClieCxUtFt6WKI11dkM4iRgE2L1aX/QwmBV/HQ9zXUKVm gQAsqy6Jo+lEcqrYrw4Ubl8rnqlfcfq07109dPiISN+lZTTK+nxh0jL62fb/6SYpxVP+ TbM+zoPYTe/yTAjdouflQaQoQf6Gm7w7V3ebjiCCiF+pCTG6cVLA0z5wMSnN+HaM1ByL q5aSHRb82i3nUhP5xZDDvNfY9Z12j2k3bmTY2z+eRUjakdOd2EFRZ8AIT17NdeyExZU/ x0EA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=KqlHLBqiHUkvpuB2ddRc/Cxj7ZLVjSxMDlcy0QdmxpM=; b=a2LDZxYyF5YpUMVlxDw0LCj5kDhfm+6iYs5Hf+0F96t8vNFsVcm/bc02RJTjLUKLOZ AxeUFH69wwbSeHvVv56YTForUhrZPaUFcopRxhQ/4bWulrppr2GsZ3hWvtz5OAZqszOp HOwO0vU0B2b2cl5bBguZG39wC3AlOHFKjuvmtLFJOu11p559V9itmzx3z4UadZJVUgwD 7fMWWeRh3vb7LbVUrsEiKt8sWmEal/CUUVdaxZoKnBcrstvyGdqEM4NEMbN8Wyz+iSUF WFbGxJnm2DhbGEzZ5ohRDCn/FO/1bV50L6XSI9bhp5aOgMu6pLIY8k4r9gJnAj+ZyGQl 88LA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=2TDjDtVd; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id f18-20020a056402329200b0043abb8a1822si8735629eda.346.2022.07.11.03.16.54; Mon, 11 Jul 2022 03:17:19 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=2TDjDtVd; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230111AbiGKJJ7 (ORCPT + 99 others); Mon, 11 Jul 2022 05:09:59 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46966 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231266AbiGKJJV (ORCPT ); Mon, 11 Jul 2022 05:09:21 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id DFE71286E3; Mon, 11 Jul 2022 02:08:07 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 4DF9FB80E5E; Mon, 11 Jul 2022 09:08:06 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9E82DC34115; Mon, 11 Jul 2022 09:08:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1657530485; bh=vb+0lighot6AX9XY2AUdCpU/s0sy+Et1zMwoqyMhtNA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=2TDjDtVdqXUK38/2rhiXngxCuZcrpHp7Ed8OYCEYAsAron6Gmp3Fb0isFqoghFbPM VnUxwQLW0l9TlZsC8mp+Hzq03fWelB3RvZo/ChjMn+qPzxwVKUh855hl2VR8EmVJ5y MC/q6MjCx4ZbcjbdgXQfMNN4wb1QoQz0lmgOdKUA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Oliver Neukum , Jakub Kicinski Subject: [PATCH 4.14 05/17] usbnet: fix memory leak in error case Date: Mon, 11 Jul 2022 11:06:30 +0200 Message-Id: <20220711090536.416927837@linuxfoundation.org> X-Mailer: git-send-email 2.37.0 In-Reply-To: <20220711090536.245939953@linuxfoundation.org> References: <20220711090536.245939953@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Spam-Status: No, score=-7.7 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_HI, SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Oliver Neukum commit b55a21b764c1e182014630fa5486d717484ac58f upstream. usbnet_write_cmd_async() mixed up which buffers need to be freed in which error case. v2: add Fixes tag v3: fix uninitialized buf pointer Fixes: 877bd862f32b8 ("usbnet: introduce usbnet 3 command helpers") Signed-off-by: Oliver Neukum Link: https://lore.kernel.org/r/20220705125351.17309-1-oneukum@suse.com Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman --- drivers/net/usb/usbnet.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) --- a/drivers/net/usb/usbnet.c +++ b/drivers/net/usb/usbnet.c @@ -2135,7 +2135,7 @@ static void usbnet_async_cmd_cb(struct u int usbnet_write_cmd_async(struct usbnet *dev, u8 cmd, u8 reqtype, u16 value, u16 index, const void *data, u16 size) { - struct usb_ctrlrequest *req = NULL; + struct usb_ctrlrequest *req; struct urb *urb; int err = -ENOMEM; void *buf = NULL; @@ -2153,7 +2153,7 @@ int usbnet_write_cmd_async(struct usbnet if (!buf) { netdev_err(dev->net, "Error allocating buffer" " in %s!\n", __func__); - goto fail_free; + goto fail_free_urb; } } @@ -2177,14 +2177,21 @@ int usbnet_write_cmd_async(struct usbnet if (err < 0) { netdev_err(dev->net, "Error submitting the control" " message: status=%d\n", err); - goto fail_free; + goto fail_free_all; } return 0; +fail_free_all: + kfree(req); fail_free_buf: kfree(buf); -fail_free: - kfree(req); + /* + * avoid a double free + * needed because the flag can be set only + * after filling the URB + */ + urb->transfer_flags = 0; +fail_free_urb: usb_free_urb(urb); fail: return err;