tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

usbnet: fix memory leak in error case

usbnet_write_cmd_async() mixed up which buffers
need to be freed in which error case.

v2: add Fixes tag
v3: fix uninitialized buf pointer

Fixes: 877bd862f32b8 ("usbnet: introduce usbnet 3 command helpers")
Signed-off-by: Oliver Neukum <oneukum@suse.com>
Link: https://lore.kernel.org/r/20220705125351.17309-1-oneukum@suse.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

authored by

Oliver Neukum and committed by
Jakub Kicinski b55a21b7 a069a905

+12 -5
+12 -5
drivers/net/usb/usbnet.c
··· 2137 2137 int usbnet_write_cmd_async(struct usbnet *dev, u8 cmd, u8 reqtype, 2138 2138 u16 value, u16 index, const void *data, u16 size) 2139 2139 { 2140 - struct usb_ctrlrequest *req = NULL; 2140 + struct usb_ctrlrequest *req; 2141 2141 struct urb *urb; 2142 2142 int err = -ENOMEM; 2143 2143 void *buf = NULL; ··· 2155 2155 if (!buf) { 2156 2156 netdev_err(dev->net, "Error allocating buffer" 2157 2157 " in %s!\n", __func__); 2158 - goto fail_free; 2158 + goto fail_free_urb; 2159 2159 } 2160 2160 } 2161 2161 ··· 2179 2179 if (err < 0) { 2180 2180 netdev_err(dev->net, "Error submitting the control" 2181 2181 " message: status=%d\n", err); 2182 - goto fail_free; 2182 + goto fail_free_all; 2183 2183 } 2184 2184 return 0; 2185 2185 2186 + fail_free_all: 2187 + kfree(req); 2186 2188 fail_free_buf: 2187 2189 kfree(buf); 2188 - fail_free: 2189 - kfree(req); 2190 + /* 2191 + * avoid a double free 2192 + * needed because the flag can be set only 2193 + * after filling the URB 2194 + */ 2195 + urb->transfer_flags = 0; 2196 + fail_free_urb: 2190 2197 usb_free_urb(urb); 2191 2198 fail: 2192 2199 return err;