lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Fri, 07 Oct 2022 20:22:11 +0200
From:   Toke Høiland-Jørgensen <>
To:     Fedor Pchelkin <>, Kalle Valo <>
Cc:     Fedor Pchelkin <>,
        "David S. Miller" <>,
        Eric Dumazet <>,
        Jakub Kicinski <>,
        Paolo Abeni <>,
        Brooke Basile <>,,,,
        Alexey Khoroshilov <>
Subject: Re: [PATCH] ath9k: hif_usb: fix memory leak of urbs in

Fedor Pchelkin <> writes:

> Syzkaller reports a long-known leak of urbs in
> ath9k_hif_usb_dealloc_tx_urbs().
> The cause of the leak is that usb_get_urb() is called but usb_free_urb()
> (or usb_put_urb()) is not called inside usb_kill_urb() as urb->dev or
> urb->ep fields have not been initialized and usb_kill_urb() returns
> immediately.
> The patch removes trying to kill urbs located in hif_dev->tx.tx_buf
> because hif_dev->tx.tx_buf is not supposed to contain urbs which are in
> pending state (the pending urbs are stored in hif_dev->tx.tx_pending).
> The tx.tx_lock is acquired so there should not be any changes in the list.
> Found by Linux Verification Center ( with Syzkaller.
> Fixes: 03fb92a432ea ("ath9k: hif_usb: fix race condition between usb_get_urb() and usb_kill_anchored_urbs()")
> Signed-off-by: Fedor Pchelkin <>
> Signed-off-by: Alexey Khoroshilov <>

Acked-by: Toke Høiland-Jørgensen <>

Powered by blists - more mailing lists