linux-kernel - [PATCH] usb: dwc3: Fix dentry leak in dwc3_gadget_free

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20221028084919.21654-1-gengcixi@gmail.com>
Date:   Fri, 28 Oct 2022 16:49:19 +0800
From:   Cixi Geng <gengcixi@...il.com>
To:     Thinh.Nguyen@...opsys.com, gregkh@...uxfoundation.org,
        bruce.chen@...soc.com
Cc:     linux-usb@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: [PATCH] usb: dwc3: Fix dentry leak in dwc3_gadget_free_endpoints

From: Bruce Chen <bruce.chen@...soc.com>

When using debugfs_remove_recursive leaks a dentry with
a hotplug stress test, the phone runs out of memory.

Thus fix the issue by using the newly created debugfs_lookup_and_remove().

Signed-off-by: Bruce Chen <bruce.chen@...soc.com>
Signed-off-by: Cixi Geng <cixi.geng1@...soc.com>
---
 drivers/usb/dwc3/core.h    | 1 +
 drivers/usb/dwc3/debugfs.c | 3 ++-
 drivers/usb/dwc3/gadget.c  | 4 +---
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/usb/dwc3/core.h b/drivers/usb/dwc3/core.h
index 8f9959ba9fd4..ba3ecaa7f06c 100644
--- a/drivers/usb/dwc3/core.h
+++ b/drivers/usb/dwc3/core.h
@@ -1261,6 +1261,7 @@ struct dwc3 {
 	u8			num_eps;
 
 	struct dwc3_hwparams	hwparams;
+	struct dentry		*root;
 	struct debugfs_regset32	*regset;
 
 	u32			dbg_lsp_select;
diff --git a/drivers/usb/dwc3/debugfs.c b/drivers/usb/dwc3/debugfs.c
index f2b7675c7f62..b9af4a81f51d 100644
--- a/drivers/usb/dwc3/debugfs.c
+++ b/drivers/usb/dwc3/debugfs.c
@@ -911,6 +911,7 @@ void dwc3_debugfs_init(struct dwc3 *dwc)
 	dwc->regset->base = dwc->regs - DWC3_GLOBALS_REGS_START;
 
 	root = debugfs_create_dir(dev_name(dwc->dev), usb_debug_root);
+	dwc->root = root;
 	debugfs_create_regset32("regdump", 0444, root, dwc->regset);
 	debugfs_create_file("lsp_dump", 0644, root, dwc, &dwc3_lsp_fops);
 
@@ -929,6 +930,6 @@ void dwc3_debugfs_init(struct dwc3 *dwc)
 
 void dwc3_debugfs_exit(struct dwc3 *dwc)
 {
-	debugfs_remove(debugfs_lookup(dev_name(dwc->dev), usb_debug_root));
+	debugfs_remove(dwc->root);
 	kfree(dwc->regset);
 }
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 079cd333632e..6d6c188fcbea 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -3172,9 +3172,7 @@ static void dwc3_gadget_free_endpoints(struct dwc3 *dwc)
 			list_del(&dep->endpoint.ep_list);
 		}
 
-		debugfs_remove_recursive(debugfs_lookup(dep->name,
-				debugfs_lookup(dev_name(dep->dwc->dev),
-					       usb_debug_root)));
+		debugfs_lookup_and_remove(dep->name, dwc->root);
 		kfree(dep);
 	}
 }
-- 
2.34.1