lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Thu, 22 Sep 2022 21:25:51 -0700 From: Peilin Ye <yepeilin.cs@...il.com> To: Oliver Neukum <oneukum@...e.com>, "David S. Miller" <davem@...emloft.net>, Eric Dumazet <edumazet@...gle.com>, Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com> Cc: Peilin Ye <peilin.ye@...edance.com>, Greg Kroah-Hartman <gregkh@...uxfoundation.org>, Ming Lei <ming.lei@...onical.com>, Cong Wang <cong.wang@...edance.com>, netdev@...r.kernel.org, linux-usb@...r.kernel.org, linux-kernel@...r.kernel.org, Peilin Ye <yepeilin.cs@...il.com> Subject: [PATCH net] usbnet: Fix memory leak in usbnet_disconnect() From: Peilin Ye <peilin.ye@...edance.com> Currently usbnet_disconnect() unanchors and frees all deferred URBs using usb_scuttle_anchored_urbs(), which does not free urb->context, causing a memory leak as reported by syzbot. Use a usb_get_from_anchor() while loop instead, similar to what we did in commit 19cfe912c37b ("Bluetooth: btusb: Fix memory leak in play_deferred"). Also free urb->sg. Reported-and-tested-by: syzbot+dcd3e13cf4472f2e0ba1@...kaller.appspotmail.com Fixes: 69ee472f2706 ("usbnet & cdc-ether: Autosuspend for online devices") Fixes: 638c5115a794 ("USBNET: support DMA SG") Signed-off-by: Peilin Ye <peilin.ye@...edance.com> --- Hi all, I think we may have similar issues at other usb_scuttle_anchored_urbs() call sites. Since urb->context is (void *), should we pass a "destructor" callback to usb_scuttle_anchored_urbs(), or replace this function with usb_get_from_anchor() loops like this patch does? Please advise, thanks! Peilin Ye drivers/net/usb/usbnet.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c index fd399a8ed973..64a9a80b2309 100644 --- a/drivers/net/usb/usbnet.c +++ b/drivers/net/usb/usbnet.c @@ -1598,6 +1598,7 @@ void usbnet_disconnect (struct usb_interface *intf) struct usbnet *dev; struct usb_device *xdev; struct net_device *net; + struct urb *urb; dev = usb_get_intfdata(intf); usb_set_intfdata(intf, NULL); @@ -1614,7 +1615,11 @@ void usbnet_disconnect (struct usb_interface *intf) net = dev->net; unregister_netdev (net); - usb_scuttle_anchored_urbs(&dev->deferred); + while ((urb = usb_get_from_anchor(&dev->deferred))) { + dev_kfree_skb(urb->context); + kfree(urb->sg); + usb_free_urb(urb); + } if (dev->driver_info->unbind) dev->driver_info->unbind(dev, intf); -- 2.20.1
Powered by blists - more mailing lists