linux-kernel - Re: [PATCH] can: pcan_usb_core: fix memory leak on failure paths in peak_usb

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <52285006.3080303@pengutronix.de>
Date:	Thu, 05 Sep 2013 11:33:58 +0200
From:	Marc Kleine-Budde <mkl@...gutronix.de>
To:	Alexey Khoroshilov <khoroshilov@...ras.ru>
CC:	Wolfgang Grandegger <wg@...ndegger.com>, linux-can@...r.kernel.org,
	netdev@...r.kernel.org, linux-kernel@...r.kernel.org,
	ldv-project@...uxtesting.org,
	"s.grosjean@...k-system.com" <s.grosjean@...k-system.com>
Subject: Re: [PATCH] can: pcan_usb_core: fix memory leak on failure paths
 in peak_usb_start()

Added Stephane to Cc.

On 09/04/2013 11:46 PM, Alexey Khoroshilov wrote:
> Tx and rx urbs are not deallocated if something goes wrong in peak_usb_start().
> The patch fixes error handling to deallocate all the resources.
> 
> Found by Linux Driver Verification project (linuxtesting.org).
> 
> Signed-off-by: Alexey Khoroshilov <khoroshilov@...ras.ru>

Stephane, can you have a look at the patch and give your Acked-by.

Looks good to me.

tnx,
Marc
> ---
>  drivers/net/can/usb/peak_usb/pcan_usb_core.c | 15 +++++++++++----
>  1 file changed, 11 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_core.c b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
> index a0f647f..0b7a4c3 100644
> --- a/drivers/net/can/usb/peak_usb/pcan_usb_core.c
> +++ b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
> @@ -463,7 +463,7 @@ static int peak_usb_start(struct peak_usb_device *dev)
>  	if (i < PCAN_USB_MAX_TX_URBS) {
>  		if (i == 0) {
>  			netdev_err(netdev, "couldn't setup any tx URB\n");
> -			return err;
> +			goto err_tx;
>  		}
>  
>  		netdev_warn(netdev, "tx performance may be slow\n");
> @@ -472,7 +472,7 @@ static int peak_usb_start(struct peak_usb_device *dev)
>  	if (dev->adapter->dev_start) {
>  		err = dev->adapter->dev_start(dev);
>  		if (err)
> -			goto failed;
> +			goto err_adapter;
>  	}
>  
>  	dev->state |= PCAN_USB_STATE_STARTED;
> @@ -481,19 +481,26 @@ static int peak_usb_start(struct peak_usb_device *dev)
>  	if (dev->adapter->dev_set_bus) {
>  		err = dev->adapter->dev_set_bus(dev, 1);
>  		if (err)
> -			goto failed;
> +			goto err_adapter;
>  	}
>  
>  	dev->can.state = CAN_STATE_ERROR_ACTIVE;
>  
>  	return 0;
>  
> -failed:
> +err_adapter:
>  	if (err == -ENODEV)
>  		netif_device_detach(dev->netdev);
>  
>  	netdev_warn(netdev, "couldn't submit control: %d\n", err);
>  
> +	for (i = 0; i < PCAN_USB_MAX_TX_URBS; i++) {
> +		usb_free_urb(dev->tx_contexts[i].urb);
> +		dev->tx_contexts[i].urb = NULL;
> +	}
> +err_tx:
> +	usb_kill_anchored_urbs(&dev->rx_submitted);
> +
>  	return err;
>  }
>  
> 


-- 
Pengutronix e.K.                  | Marc Kleine-Budde           |
Industrial Linux Solutions        | Phone: +49-231-2826-924     |
Vertretung West/Dortmund          | Fax:   +49-5121-206917-5555 |
Amtsgericht Hildesheim, HRA 2686  | http://www.pengutronix.de   |


Download attachment "signature.asc" of type "application/pgp-signature" (260 bytes)