| From 8747c9e976b143a50cffa7f1f80165ffe05b0c39 Mon Sep 17 00:00:00 2001 |
| From: Eric Dumazet <edumazet@google.com> |
| Date: Tue, 7 Jan 2020 10:57:01 -0800 |
| Subject: [PATCH] net: usb: lan78xx: fix possible skb leak |
| |
| commit 47240ba0cd09bb6fe6db9889582048324999dfa4 upstream. |
| |
| If skb_linearize() fails, we need to free the skb. |
| |
| TSO makes skb bigger, and this bug might be the reason |
| Raspberry Pi 3B+ users had to disable TSO. |
| |
| Fixes: 55d7de9de6c3 ("Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet device driver") |
| Signed-off-by: Eric Dumazet <edumazet@google.com> |
| Reported-by: RENARD Pierre-Francois <pfrenard@gmail.com> |
| Cc: Stefan Wahren <stefan.wahren@i2se.com> |
| Cc: Woojung Huh <woojung.huh@microchip.com> |
| Cc: Microchip Linux Driver Support <UNGLinuxDriver@microchip.com> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> |
| |
| diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c |
| index c86b61095600..2999cae8654e 100644 |
| --- a/drivers/net/usb/lan78xx.c |
| +++ b/drivers/net/usb/lan78xx.c |
| @@ -2725,11 +2725,6 @@ static int lan78xx_stop(struct net_device *net) |
| return 0; |
| } |
| |
| -static int lan78xx_linearize(struct sk_buff *skb) |
| -{ |
| - return skb_linearize(skb); |
| -} |
| - |
| static struct sk_buff *lan78xx_tx_prep(struct lan78xx_net *dev, |
| struct sk_buff *skb, gfp_t flags) |
| { |
| @@ -2740,8 +2735,10 @@ static struct sk_buff *lan78xx_tx_prep(struct lan78xx_net *dev, |
| return NULL; |
| } |
| |
| - if (lan78xx_linearize(skb) < 0) |
| + if (skb_linearize(skb)) { |
| + dev_kfree_skb_any(skb); |
| return NULL; |
| + } |
| |
| tx_cmd_a = (u32)(skb->len & TX_CMD_A_LEN_MASK_) | TX_CMD_A_FCS_; |
| |
| -- |
| 2.7.4 |
| |
