[PATCH 03/19] usbip: vudc: free the unlink item if the send fails

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

From: Josef Bacik <josef@toxicpanda.com>

v_send_ret() takes an item off udc->tx_queue, hands what it carries to
v_send_ret_submit() or v_send_ret_unlink(), and frees only the item
itself. v_send_ret_submit() releases its urbp on all paths behind the
first check; v_send_ret_unlink() frees the struct v_unlink only after a
complete send. When the connection breaks while a RET_UNLINK is being
sent, the v_unlink is leaked.

The reply has been built from it before the send: free it right after
kernel_sendmsg().

Fixes: d62ba981a9de ("usbip: vudc: Add vudc_tx")
Cc: stable <stable@kernel.org>
Cc: Valentina Manea <valentina.manea.m@gmail.com>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Hongren Zheng <i@zenithal.me>
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/usb/usbip/vudc_tx.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/usbip/vudc_tx.c b/drivers/usb/usbip/vudc_tx.c
index 88edfbcc0035..d78ff29e9654 100644
--- a/drivers/usb/usbip/vudc_tx.c
+++ b/drivers/usb/usbip/vudc_tx.c
@@ -59,13 +59,13 @@ static int v_send_ret_unlink(struct vudc *udc, struct v_unlink *unlink)
 
 	ret = kernel_sendmsg(udc->ud.tcp_socket, &msg, iov,
 			     1, txsize);
+	kfree(unlink);
 	if (ret != txsize) {
 		usbip_event_add(&udc->ud, VUDC_EVENT_ERROR_TCP);
 		if (ret >= 0)
 			return -EPIPE;
 		return ret;
 	}
-	kfree(unlink);
 
 	return txsize;
 }

-- 
2.56.0