* [PATCH] cdc-phonet: Don't leak in usbpn_open
@ 2012-08-07 21:56 Jesper Juhl
2012-08-08 7:12 ` Rémi Denis-Courmont
0 siblings, 1 reply; 3+ messages in thread
From: Jesper Juhl @ 2012-08-07 21:56 UTC (permalink / raw)
To: linux-kernel
Cc: netdev, linux-usb, Greg Kroah-Hartman, Rémi Denis-Courmont,
Remi Denis-Courmont
We allocate memory for 'req' with usb_alloc_urb() and then test
'if (!req || rx_submit(pnd, req, GFP_KERNEL | __GFP_COLD))'.
If we enter that branch due to '!req' then there is no problem. But if
we enter the branch due to 'req' being != 0 and the 'rx_submit()' call
being false, then we'll leak the memory we allocated.
Deal with the leak by always calling 'usb_free_urb(req)' when entering
the branch. If 'req' happens to be 0 then the call is harmless, if it
is not 0 then we free the memory we allocated but don't need.
Signed-off-by: Jesper Juhl <jj@chaosbits.net>
---
drivers/net/usb/cdc-phonet.c | 1 +
1 file changed, 1 insertion(+)
Only compile tested due to lack of hardware.
diff --git a/drivers/net/usb/cdc-phonet.c b/drivers/net/usb/cdc-phonet.c
index 6461004..7d78669 100644
--- a/drivers/net/usb/cdc-phonet.c
+++ b/drivers/net/usb/cdc-phonet.c
@@ -232,6 +232,7 @@ static int usbpn_open(struct net_device *dev)
struct urb *req = usb_alloc_urb(0, GFP_KERNEL);
if (!req || rx_submit(pnd, req, GFP_KERNEL | __GFP_COLD)) {
+ usb_free_urb(req);
usbpn_close(dev);
return -ENOMEM;
}
--
1.7.11.4
--
Jesper Juhl <jj@chaosbits.net> http://www.chaosbits.net/
Don't top-post http://www.catb.org/jargon/html/T/top-post.html
Plain text mails only, please.
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] cdc-phonet: Don't leak in usbpn_open
2012-08-07 21:56 [PATCH] cdc-phonet: Don't leak in usbpn_open Jesper Juhl
@ 2012-08-08 7:12 ` Rémi Denis-Courmont
2012-08-08 23:05 ` David Miller
0 siblings, 1 reply; 3+ messages in thread
From: Rémi Denis-Courmont @ 2012-08-08 7:12 UTC (permalink / raw)
To: Jesper Juhl; +Cc: linux-kernel, netdev, linux-usb, Greg Kroah-Hartman
Le mercredi 8 août 2012 00:56:26 Jesper Juhl, vous avez écrit :
> We allocate memory for 'req' with usb_alloc_urb() and then test
> 'if (!req || rx_submit(pnd, req, GFP_KERNEL | __GFP_COLD))'.
> If we enter that branch due to '!req' then there is no problem. But if
> we enter the branch due to 'req' being != 0 and the 'rx_submit()' call
> being false, then we'll leak the memory we allocated.
> Deal with the leak by always calling 'usb_free_urb(req)' when entering
> the branch. If 'req' happens to be 0 then the call is harmless, if it
> is not 0 then we free the memory we allocated but don't need.
>
> Signed-off-by: Jesper Juhl <jj@chaosbits.net>
Acked-by: Rémi Denis-Courmont <remi@remlab.net>
> ---
> drivers/net/usb/cdc-phonet.c | 1 +
> 1 file changed, 1 insertion(+)
>
> Only compile tested due to lack of hardware.
Hardware won't help you much with testing the error case anyway.
--
Rémi Denis-Courmont, looking for a job
http://www.remlab.net/
http://fi.linkedin.com/in/remidenis
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] cdc-phonet: Don't leak in usbpn_open
2012-08-08 7:12 ` Rémi Denis-Courmont
@ 2012-08-08 23:05 ` David Miller
0 siblings, 0 replies; 3+ messages in thread
From: David Miller @ 2012-08-08 23:05 UTC (permalink / raw)
To: remi; +Cc: jj, linux-kernel, netdev, linux-usb, gregkh
From: "Rémi Denis-Courmont" <remi@remlab.net>
Date: Wed, 8 Aug 2012 10:12:06 +0300
> Le mercredi 8 août 2012 00:56:26 Jesper Juhl, vous avez écrit :
>> We allocate memory for 'req' with usb_alloc_urb() and then test
>> 'if (!req || rx_submit(pnd, req, GFP_KERNEL | __GFP_COLD))'.
>> If we enter that branch due to '!req' then there is no problem. But if
>> we enter the branch due to 'req' being != 0 and the 'rx_submit()' call
>> being false, then we'll leak the memory we allocated.
>> Deal with the leak by always calling 'usb_free_urb(req)' when entering
>> the branch. If 'req' happens to be 0 then the call is harmless, if it
>> is not 0 then we free the memory we allocated but don't need.
>>
>> Signed-off-by: Jesper Juhl <jj@chaosbits.net>
>
> Acked-by: Rémi Denis-Courmont <remi@remlab.net>
Applied.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2012-08-08 23:05 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2012-08-07 21:56 [PATCH] cdc-phonet: Don't leak in usbpn_open Jesper Juhl
2012-08-08 7:12 ` Rémi Denis-Courmont
2012-08-08 23:05 ` David Miller
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.