From: Oliver Neukum <oneukum@suse.com>
To: syzbot+44d53c7255bb1aea22d2@syzkaller.appspotmail.com
Cc: Andrey Konovalov <andreyknvl@google.com>, linux-usb@vger.kernel.org
Subject: Re: WARNING in hso_free_net_device
Date: Tue, 19 Nov 2019 16:16:43 +0100 [thread overview]
Message-ID: <1574176603.28617.25.camel@suse.com> (raw)
#syz test: https://github.com/google/kasan.git eea39f24
From 9293e8ccebbe11e9f04f7ed88a0029e52d2aa617 Mon Sep 17 00:00:00 2001
From: Oliver Neukum <oneukum@suse.com>
Date: Tue, 19 Nov 2019 16:11:31 +0100
Subject: [PATCH] hso: fix bailout in error case of probe
If resources need to be freed after an error in probe, the
netdev must not be freed because it has never been registered.
The network layer dislikes that.
Signed-off-by: Oliver Neukum <oneukum@suse.com>
---
drivers/net/usb/hso.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
index dfb8dbbc8015..1b767c1c1411 100644
--- a/drivers/net/usb/hso.c
+++ b/drivers/net/usb/hso.c
@@ -2351,7 +2351,7 @@ static int remove_net_device(struct hso_device *hso_dev)
}
/* Frees our network device */
-static void hso_free_net_device(struct hso_device *hso_dev)
+static void hso_free_net_device(struct hso_device *hso_dev, bool bailout)
{
int i;
struct hso_net *hso_net = dev2net(hso_dev);
@@ -2374,7 +2374,7 @@ static void hso_free_net_device(struct hso_device *hso_dev)
kfree(hso_net->mux_bulk_tx_buf);
hso_net->mux_bulk_tx_buf = NULL;
- if (hso_net->net)
+ if (hso_net->net && !bailout)
free_netdev(hso_net->net);
kfree(hso_dev);
@@ -2549,7 +2549,7 @@ static struct hso_device *hso_create_net_device(struct usb_interface *interface,
return hso_dev;
exit:
- hso_free_net_device(hso_dev);
+ hso_free_net_device(hso_dev, true);
return NULL;
}
@@ -3126,7 +3126,7 @@ static void hso_free_interface(struct usb_interface *interface)
rfkill_unregister(rfk);
rfkill_destroy(rfk);
}
- hso_free_net_device(network_table[i]);
+ hso_free_net_device(network_table[i], false);
}
}
}
next reply other threads:[~2019-11-19 15:16 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-11-19 15:16 Oliver Neukum [this message]
2019-11-20 23:37 ` WARNING in hso_free_net_device syzbot
[not found] <1574176549.28617.24.camel@neukum.org>
2019-11-20 23:27 ` syzbot
-- strict thread matches above, loose matches on Subject: below --
2019-09-03 12:08 syzbot
2019-09-04 20:27 ` Hui Peng
2019-09-04 22:41 ` Stephen Hemminger
2019-09-05 2:20 ` Hui Peng
2019-09-05 11:24 ` Andrey Konovalov
2019-09-05 11:47 ` syzbot
2019-09-06 2:05 ` Hui Peng
2019-09-09 9:47 ` Oliver Neukum
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1574176603.28617.25.camel@suse.com \
--to=oneukum@suse.com \
--cc=andreyknvl@google.com \
--cc=linux-usb@vger.kernel.org \
--cc=syzbot+44d53c7255bb1aea22d2@syzkaller.appspotmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).