All of lore.kernel.org
 help / color / mirror / Atom feed
From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Xiyu Yang <xiyuyang19@fudan.edu.cn>,
	Xin Tan <tanxin.ctf@gmail.com>,
	"David S . Miller" <davem@davemloft.net>,
	Sasha Levin <sashal@kernel.org>,
	netdev@vger.kernel.org
Subject: [PATCH AUTOSEL 4.14 11/27] wimax/i2400m: Fix potential urb refcnt leak
Date: Thu, 30 Apr 2020 09:53:46 -0400	[thread overview]
Message-ID: <20200430135402.20994-11-sashal@kernel.org> (raw)
In-Reply-To: <20200430135402.20994-1-sashal@kernel.org>

From: Xiyu Yang <xiyuyang19@fudan.edu.cn>

[ Upstream commit 7717cbec172c3554d470023b4020d5781961187e ]

i2400mu_bus_bm_wait_for_ack() invokes usb_get_urb(), which increases the
refcount of the "notif_urb".

When i2400mu_bus_bm_wait_for_ack() returns, local variable "notif_urb"
becomes invalid, so the refcount should be decreased to keep refcount
balanced.

The issue happens in all paths of i2400mu_bus_bm_wait_for_ack(), which
forget to decrease the refcnt increased by usb_get_urb(), causing a
refcnt leak.

Fix this issue by calling usb_put_urb() before the
i2400mu_bus_bm_wait_for_ack() returns.

Signed-off-by: Xiyu Yang <xiyuyang19@fudan.edu.cn>
Signed-off-by: Xin Tan <tanxin.ctf@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/wimax/i2400m/usb-fw.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/wimax/i2400m/usb-fw.c b/drivers/net/wimax/i2400m/usb-fw.c
index 502c346aa790b..7d396c81ec3eb 100644
--- a/drivers/net/wimax/i2400m/usb-fw.c
+++ b/drivers/net/wimax/i2400m/usb-fw.c
@@ -354,6 +354,7 @@ out:
 		usb_autopm_put_interface(i2400mu->usb_iface);
 	d_fnend(8, dev, "(i2400m %p ack %p size %zu) = %ld\n",
 		i2400m, ack, ack_size, (long) result);
+	usb_put_urb(&notif_urb);
 	return result;
 
 error_exceeded:
-- 
2.20.1


  parent reply	other threads:[~2020-04-30 13:56 UTC|newest]

Thread overview: 33+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-04-30 13:53 [PATCH AUTOSEL 4.14 01/27] iio:ad7797: Use correct attribute_group Sasha Levin
2020-04-30 13:53 ` [PATCH AUTOSEL 4.14 02/27] iio: adc: stm32-adc: fix sleep in atomic context Sasha Levin
2020-04-30 13:53   ` Sasha Levin
2020-04-30 13:53 ` [PATCH AUTOSEL 4.14 03/27] ASoC: topology: Check return value of pcm_new_ver Sasha Levin
2020-04-30 13:53   ` Sasha Levin
2020-04-30 13:53 ` [PATCH AUTOSEL 4.14 04/27] nfsd: memory corruption in nfsd4_lock() Sasha Levin
2020-04-30 13:53 ` [PATCH AUTOSEL 4.14 05/27] selftests/ipc: Fix test failure seen after initial test run Sasha Levin
2020-04-30 13:53 ` [PATCH AUTOSEL 4.14 06/27] ASoC: sgtl5000: Fix VAG power-on handling Sasha Levin
2020-04-30 13:53   ` Sasha Levin
2020-04-30 13:53 ` [PATCH AUTOSEL 4.14 07/27] usb: dwc3: gadget: Do link recovery for SS and SSP Sasha Levin
2020-04-30 13:53 ` [PATCH AUTOSEL 4.14 08/27] ASoC: rsnd: Fix HDMI channel mapping for multi-SSI mode Sasha Levin
2020-04-30 13:53   ` Sasha Levin
2020-04-30 13:53 ` [PATCH AUTOSEL 4.14 09/27] ASoC: codecs: hdac_hdmi: Fix incorrect use of list_for_each_entry Sasha Levin
2020-04-30 13:53   ` Sasha Levin
2020-04-30 13:53 ` [PATCH AUTOSEL 4.14 10/27] ARM: dts: bcm283x: Disable dsi0 node Sasha Levin
2020-04-30 13:53   ` Sasha Levin
2020-04-30 13:53 ` Sasha Levin [this message]
2020-04-30 13:53 ` [PATCH AUTOSEL 4.14 12/27] net: stmmac: fix enabling socfpga's ptp_ref_clock Sasha Levin
2020-04-30 13:53 ` [PATCH AUTOSEL 4.14 13/27] net: stmmac: Fix sub-second increment Sasha Levin
2020-04-30 13:53 ` [PATCH AUTOSEL 4.14 14/27] cxgb4: fix large delays in PTP synchronization Sasha Levin
2020-04-30 13:53 ` [PATCH AUTOSEL 4.14 15/27] team: fix hang in team_mode_get() Sasha Levin
2020-04-30 13:53 ` [PATCH AUTOSEL 4.14 16/27] cifs: protect updating server->dstaddr with a spinlock Sasha Levin
2020-04-30 13:53 ` [PATCH AUTOSEL 4.14 17/27] macvlan: fix null dereference in macvlan_device_event() Sasha Levin
2020-04-30 13:53 ` [PATCH AUTOSEL 4.14 18/27] s390/ftrace: fix potential crashes when switching tracers Sasha Levin
2020-04-30 13:53 ` [PATCH AUTOSEL 4.14 19/27] scripts/config: allow colons in option strings for sed Sasha Levin
2020-04-30 13:53 ` [PATCH AUTOSEL 4.14 20/27] net: dsa: b53: Fix ARL register definitions Sasha Levin
2020-04-30 13:53 ` [PATCH AUTOSEL 4.14 21/27] net: dsa: b53: Rework ARL bin logic Sasha Levin
2020-04-30 13:53 ` [PATCH AUTOSEL 4.14 22/27] perf/core: fix parent pid/tid in task exit events Sasha Levin
2020-04-30 13:53 ` [PATCH AUTOSEL 4.14 23/27] net: bcmgenet: correct per TX/RX ring statistics Sasha Levin
2020-04-30 13:53 ` [PATCH AUTOSEL 4.14 24/27] lib/mpi: Fix building for powerpc with clang Sasha Levin
2020-04-30 13:54 ` [PATCH AUTOSEL 4.14 25/27] macsec: avoid to set wrong mtu Sasha Levin
2020-04-30 13:54 ` [PATCH AUTOSEL 4.14 26/27] net: bcmgenet: suppress warnings on failed Rx SKB allocations Sasha Levin
2020-04-30 13:54 ` [PATCH AUTOSEL 4.14 27/27] net: systemport: " Sasha Levin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200430135402.20994-11-sashal@kernel.org \
    --to=sashal@kernel.org \
    --cc=davem@davemloft.net \
    --cc=linux-kernel@vger.kernel.org \
    --cc=netdev@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    --cc=tanxin.ctf@gmail.com \
    --cc=xiyuyang19@fudan.edu.cn \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.