From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Pavel Skripkin <paskripkin@gmail.com>,
syzbot+28a246747e0a465127f3@syzkaller.appspotmail.com,
"David S . Miller" <davem@davemloft.net>,
Sasha Levin <sashal@kernel.org>,
linux-wpan@vger.kernel.org, netdev@vger.kernel.org
Subject: [PATCH AUTOSEL 4.9 06/23] drivers: net: fix memory leak in atusb_probe
Date: Mon, 12 Apr 2021 12:26:47 -0400 [thread overview]
Message-ID: <20210412162704.315783-6-sashal@kernel.org> (raw)
In-Reply-To: <20210412162704.315783-1-sashal@kernel.org>
From: Pavel Skripkin <paskripkin@gmail.com>
[ Upstream commit 6b9fbe16955152626557ec6f439f3407b7769941 ]
syzbot reported memory leak in atusb_probe()[1].
The problem was in atusb_alloc_urbs().
Since urb is anchored, we need to release the reference
to correctly free the urb
backtrace:
[<ffffffff82ba0466>] kmalloc include/linux/slab.h:559 [inline]
[<ffffffff82ba0466>] usb_alloc_urb+0x66/0xe0 drivers/usb/core/urb.c:74
[<ffffffff82ad3888>] atusb_alloc_urbs drivers/net/ieee802154/atusb.c:362 [inline][2]
[<ffffffff82ad3888>] atusb_probe+0x158/0x820 drivers/net/ieee802154/atusb.c:1038 [1]
Reported-by: syzbot+28a246747e0a465127f3@syzkaller.appspotmail.com
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ieee802154/atusb.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/ieee802154/atusb.c b/drivers/net/ieee802154/atusb.c
index 12df6cfb423a..0ee54fba0a23 100644
--- a/drivers/net/ieee802154/atusb.c
+++ b/drivers/net/ieee802154/atusb.c
@@ -341,6 +341,7 @@ static int atusb_alloc_urbs(struct atusb *atusb, int n)
return -ENOMEM;
}
usb_anchor_urb(urb, &atusb->idle_urbs);
+ usb_free_urb(urb);
n--;
}
return 0;
--
2.30.2
next prev parent reply other threads:[~2021-04-12 16:48 UTC|newest]
Thread overview: 27+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-04-12 16:26 [PATCH AUTOSEL 4.9 01/23] net: ieee802154: nl-mac: fix check on panid Sasha Levin
2021-04-12 16:26 ` [PATCH AUTOSEL 4.9 02/23] ARM: dts: Fix moving mmc devices with aliases for omap4 & 5 Sasha Levin
2021-04-12 16:26 ` [PATCH AUTOSEL 4.9 03/23] arc: kernel: Return -EFAULT if copy_to_user() fails Sasha Levin
2021-04-12 16:26 ` Sasha Levin
2021-04-12 16:26 ` [PATCH AUTOSEL 4.9 04/23] neighbour: Disregard DEAD dst in neigh_update Sasha Levin
2021-04-12 16:26 ` [PATCH AUTOSEL 4.9 05/23] ARM: keystone: fix integer overflow warning Sasha Levin
2021-04-12 16:26 ` Sasha Levin
2021-04-12 16:26 ` Sasha Levin [this message]
2021-04-12 16:26 ` [PATCH AUTOSEL 4.9 07/23] drivers: net: fix memory leak in peak_usb_create_dev Sasha Levin
2021-04-12 16:26 ` [PATCH AUTOSEL 4.9 08/23] ASoC: fsl_esai: Fix TDM slot setup for I2S mode Sasha Levin
2021-04-12 16:26 ` Sasha Levin
2021-04-12 16:26 ` [PATCH AUTOSEL 4.9 09/23] net: ieee802154: forbid monitor for set llsec params Sasha Levin
2021-04-12 16:26 ` [PATCH AUTOSEL 4.9 10/23] net: ieee802154: stop dump llsec keys for monitors Sasha Levin
2021-04-12 16:26 ` [PATCH AUTOSEL 4.9 11/23] net: ieee802154: stop dump llsec devs " Sasha Levin
2021-04-12 16:26 ` [PATCH AUTOSEL 4.9 12/23] net: ieee802154: forbid monitor for add llsec dev Sasha Levin
2021-04-12 16:26 ` [PATCH AUTOSEL 4.9 13/23] net: ieee802154: stop dump llsec devkeys for monitors Sasha Levin
2021-04-12 16:26 ` [PATCH AUTOSEL 4.9 14/23] net: ieee802154: forbid monitor for add llsec devkey Sasha Levin
2021-04-12 16:26 ` [PATCH AUTOSEL 4.9 15/23] net: ieee802154: stop dump llsec seclevels for monitors Sasha Levin
2021-04-12 16:26 ` [PATCH AUTOSEL 4.9 16/23] net: ieee802154: forbid monitor for add llsec seclevel Sasha Levin
2021-04-12 16:26 ` [PATCH AUTOSEL 4.9 17/23] net: ieee802154: forbid monitor for del " Sasha Levin
2021-04-12 16:26 ` [PATCH AUTOSEL 4.9 18/23] net: ieee802154: stop dump llsec params for monitors Sasha Levin
2021-04-12 16:27 ` [PATCH AUTOSEL 4.9 19/23] net: mac802154: Fix general protection fault Sasha Levin
2021-04-12 16:27 ` [PATCH AUTOSEL 4.9 20/23] pcnet32: Use pci_resource_len to validate PCI resource Sasha Levin
2021-04-12 16:27 ` Sasha Levin
2021-04-12 16:27 ` [PATCH AUTOSEL 4.9 21/23] net/rds: Avoid potential use after free in rds_send_remove_from_sock Sasha Levin
2021-04-12 16:27 ` [PATCH AUTOSEL 4.9 22/23] net: tipc: Fix spelling errors in net/tipc module Sasha Levin
2021-04-12 16:27 ` [PATCH AUTOSEL 4.9 23/23] cfg80211: remove WARN_ON() in cfg80211_sme_connect Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210412162704.315783-6-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=davem@davemloft.net \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-wpan@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=paskripkin@gmail.com \
--cc=stable@vger.kernel.org \
--cc=syzbot+28a246747e0a465127f3@syzkaller.appspotmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.