From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Xiyu Yang <xiyuyang19@fudan.edu.cn>,
Xin Tan <tanxin.ctf@gmail.com>,
"David S . Miller" <davem@davemloft.net>,
Sasha Levin <sashal@kernel.org>,
netdev@vger.kernel.org
Subject: [PATCH AUTOSEL 4.14 11/27] wimax/i2400m: Fix potential urb refcnt leak
Date: Thu, 30 Apr 2020 09:53:46 -0400 [thread overview]
Message-ID: <20200430135402.20994-11-sashal@kernel.org> (raw)
In-Reply-To: <20200430135402.20994-1-sashal@kernel.org>
From: Xiyu Yang <xiyuyang19@fudan.edu.cn>
[ Upstream commit 7717cbec172c3554d470023b4020d5781961187e ]
i2400mu_bus_bm_wait_for_ack() invokes usb_get_urb(), which increases the
refcount of the "notif_urb".
When i2400mu_bus_bm_wait_for_ack() returns, local variable "notif_urb"
becomes invalid, so the refcount should be decreased to keep refcount
balanced.
The issue happens in all paths of i2400mu_bus_bm_wait_for_ack(), which
forget to decrease the refcnt increased by usb_get_urb(), causing a
refcnt leak.
Fix this issue by calling usb_put_urb() before the
i2400mu_bus_bm_wait_for_ack() returns.
Signed-off-by: Xiyu Yang <xiyuyang19@fudan.edu.cn>
Signed-off-by: Xin Tan <tanxin.ctf@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wimax/i2400m/usb-fw.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/wimax/i2400m/usb-fw.c b/drivers/net/wimax/i2400m/usb-fw.c
index 502c346aa790b..7d396c81ec3eb 100644
--- a/drivers/net/wimax/i2400m/usb-fw.c
+++ b/drivers/net/wimax/i2400m/usb-fw.c
@@ -354,6 +354,7 @@ out:
usb_autopm_put_interface(i2400mu->usb_iface);
d_fnend(8, dev, "(i2400m %p ack %p size %zu) = %ld\n",
i2400m, ack, ack_size, (long) result);
+ usb_put_urb(¬if_urb);
return result;
error_exceeded:
--
2.20.1
next prev parent reply other threads:[~2020-04-30 13:56 UTC|newest]
Thread overview: 27+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-04-30 13:53 [PATCH AUTOSEL 4.14 01/27] iio:ad7797: Use correct attribute_group Sasha Levin
2020-04-30 13:53 ` [PATCH AUTOSEL 4.14 02/27] iio: adc: stm32-adc: fix sleep in atomic context Sasha Levin
2020-04-30 13:53 ` [PATCH AUTOSEL 4.14 03/27] ASoC: topology: Check return value of pcm_new_ver Sasha Levin
2020-04-30 13:53 ` [PATCH AUTOSEL 4.14 04/27] nfsd: memory corruption in nfsd4_lock() Sasha Levin
2020-04-30 13:53 ` [PATCH AUTOSEL 4.14 05/27] selftests/ipc: Fix test failure seen after initial test run Sasha Levin
2020-04-30 13:53 ` [PATCH AUTOSEL 4.14 06/27] ASoC: sgtl5000: Fix VAG power-on handling Sasha Levin
2020-04-30 13:53 ` [PATCH AUTOSEL 4.14 07/27] usb: dwc3: gadget: Do link recovery for SS and SSP Sasha Levin
2020-04-30 13:53 ` [PATCH AUTOSEL 4.14 08/27] ASoC: rsnd: Fix HDMI channel mapping for multi-SSI mode Sasha Levin
2020-04-30 13:53 ` [PATCH AUTOSEL 4.14 09/27] ASoC: codecs: hdac_hdmi: Fix incorrect use of list_for_each_entry Sasha Levin
2020-04-30 13:53 ` [PATCH AUTOSEL 4.14 10/27] ARM: dts: bcm283x: Disable dsi0 node Sasha Levin
2020-04-30 13:53 ` Sasha Levin [this message]
2020-04-30 13:53 ` [PATCH AUTOSEL 4.14 12/27] net: stmmac: fix enabling socfpga's ptp_ref_clock Sasha Levin
2020-04-30 13:53 ` [PATCH AUTOSEL 4.14 13/27] net: stmmac: Fix sub-second increment Sasha Levin
2020-04-30 13:53 ` [PATCH AUTOSEL 4.14 14/27] cxgb4: fix large delays in PTP synchronization Sasha Levin
2020-04-30 13:53 ` [PATCH AUTOSEL 4.14 15/27] team: fix hang in team_mode_get() Sasha Levin
2020-04-30 13:53 ` [PATCH AUTOSEL 4.14 16/27] cifs: protect updating server->dstaddr with a spinlock Sasha Levin
2020-04-30 13:53 ` [PATCH AUTOSEL 4.14 17/27] macvlan: fix null dereference in macvlan_device_event() Sasha Levin
2020-04-30 13:53 ` [PATCH AUTOSEL 4.14 18/27] s390/ftrace: fix potential crashes when switching tracers Sasha Levin
2020-04-30 13:53 ` [PATCH AUTOSEL 4.14 19/27] scripts/config: allow colons in option strings for sed Sasha Levin
2020-04-30 13:53 ` [PATCH AUTOSEL 4.14 20/27] net: dsa: b53: Fix ARL register definitions Sasha Levin
2020-04-30 13:53 ` [PATCH AUTOSEL 4.14 21/27] net: dsa: b53: Rework ARL bin logic Sasha Levin
2020-04-30 13:53 ` [PATCH AUTOSEL 4.14 22/27] perf/core: fix parent pid/tid in task exit events Sasha Levin
2020-04-30 13:53 ` [PATCH AUTOSEL 4.14 23/27] net: bcmgenet: correct per TX/RX ring statistics Sasha Levin
2020-04-30 13:53 ` [PATCH AUTOSEL 4.14 24/27] lib/mpi: Fix building for powerpc with clang Sasha Levin
2020-04-30 13:54 ` [PATCH AUTOSEL 4.14 25/27] macsec: avoid to set wrong mtu Sasha Levin
2020-04-30 13:54 ` [PATCH AUTOSEL 4.14 26/27] net: bcmgenet: suppress warnings on failed Rx SKB allocations Sasha Levin
2020-04-30 13:54 ` [PATCH AUTOSEL 4.14 27/27] net: systemport: " Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200430135402.20994-11-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=davem@davemloft.net \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=tanxin.ctf@gmail.com \
--cc=xiyuyang19@fudan.edu.cn \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®