linux-kernel - Re: [PATCH 09/12] drm/udl: Fix potential URB leaks

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <2a30fbbd-07bf-65e4-f72c-fe3d3d93b7be@suse.de>
Date:   Mon, 5 Sep 2022 10:16:20 +0200
From:   Thomas Zimmermann <tzimmermann@...e.de>
To:     Takashi Iwai <tiwai@...e.de>
Cc:     linux-kernel@...r.kernel.org, dri-devel@...ts.freedesktop.org
Subject: Re: [PATCH 09/12] drm/udl: Fix potential URB leaks

Hi

Am 16.08.22 um 17:36 schrieb Takashi Iwai:
> A couple of error handlings forgot to process the URB completion.
> Those are both with WARN_ON() so should be visible, but we must fix
> them in anyway.
> 
> Fixes: 7350b2a3fbc6 ("drm/udl: Replace BUG_ON() with WARN_ON()")
> Signed-off-by: Takashi Iwai <tiwai@...e.de>

Acked-by: Thomas Zimmermann <tzimmermann@...e.de>

> ---
>   drivers/gpu/drm/udl/udl_main.c     | 8 +++++---
>   drivers/gpu/drm/udl/udl_transfer.c | 5 ++++-
>   2 files changed, 9 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/gpu/drm/udl/udl_main.c b/drivers/gpu/drm/udl/udl_main.c
> index 3c97f647883f..8bbb4e2861fb 100644
> --- a/drivers/gpu/drm/udl/udl_main.c
> +++ b/drivers/gpu/drm/udl/udl_main.c
> @@ -265,11 +265,13 @@ int udl_submit_urb(struct drm_device *dev, struct urb *urb, size_t len)
>   	struct udl_device *udl = to_udl(dev);
>   	int ret;
>   
> -	if (WARN_ON(len > udl->urbs.size))
> -		return -EINVAL;
> -
> +	if (WARN_ON(len > udl->urbs.size)) {
> +		ret = -EINVAL;
> +		goto error;
> +	}
>   	urb->transfer_buffer_length = len; /* set to actual payload len */
>   	ret = usb_submit_urb(urb, GFP_ATOMIC);
> + error:
>   	if (ret) {
>   		udl_urb_completion(urb); /* because no one else will */
>   		DRM_ERROR("usb_submit_urb error %x\n", ret);
> diff --git a/drivers/gpu/drm/udl/udl_transfer.c b/drivers/gpu/drm/udl/udl_transfer.c
> index a431208dda85..b57844632dbd 100644
> --- a/drivers/gpu/drm/udl/udl_transfer.c
> +++ b/drivers/gpu/drm/udl/udl_transfer.c
> @@ -180,8 +180,11 @@ int udl_render_hline(struct drm_device *dev, int log_bpp, struct urb **urb_ptr,
>   	u8 *cmd = *urb_buf_ptr;
>   	u8 *cmd_end = (u8 *) urb->transfer_buffer + urb->transfer_buffer_length;
>   
> -	if (WARN_ON(!(log_bpp == 1 || log_bpp == 2)))
> +	if (WARN_ON(!(log_bpp == 1 || log_bpp == 2))) {
> +		/* need to finish URB at error from this function */
> +		udl_urb_completion(urb);
>   		return -EINVAL;
> +	}
>   
>   	line_start = (u8 *) (front + byte_offset);
>   	next_pixel = line_start;

-- 
Thomas Zimmermann
Graphics Driver Developer
SUSE Software Solutions Germany GmbH
Maxfeldstr. 5, 90409 Nürnberg, Germany
(HRB 36809, AG Nürnberg)
Geschäftsführer: Ivo Totev

Download attachment "OpenPGP_signature" of type "application/pgp-signature" (841 bytes)