| From febd59cc311a149756283fdf47a9258bc51dcef2 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Wed, 15 Apr 2020 16:41:20 +0800 |
| Subject: wimax/i2400m: Fix potential urb refcnt leak |
| |
| From: Xiyu Yang <xiyuyang19@fudan.edu.cn> |
| |
| [ Upstream commit 7717cbec172c3554d470023b4020d5781961187e ] |
| |
| i2400mu_bus_bm_wait_for_ack() invokes usb_get_urb(), which increases the |
| refcount of the "notif_urb". |
| |
| When i2400mu_bus_bm_wait_for_ack() returns, local variable "notif_urb" |
| becomes invalid, so the refcount should be decreased to keep refcount |
| balanced. |
| |
| The issue happens in all paths of i2400mu_bus_bm_wait_for_ack(), which |
| forget to decrease the refcnt increased by usb_get_urb(), causing a |
| refcnt leak. |
| |
| Fix this issue by calling usb_put_urb() before the |
| i2400mu_bus_bm_wait_for_ack() returns. |
| |
| Signed-off-by: Xiyu Yang <xiyuyang19@fudan.edu.cn> |
| Signed-off-by: Xin Tan <tanxin.ctf@gmail.com> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/net/wimax/i2400m/usb-fw.c | 1 + |
| 1 file changed, 1 insertion(+) |
| |
| diff --git a/drivers/net/wimax/i2400m/usb-fw.c b/drivers/net/wimax/i2400m/usb-fw.c |
| index 529ebca1e9e13..1f7709d24f352 100644 |
| --- a/drivers/net/wimax/i2400m/usb-fw.c |
| +++ b/drivers/net/wimax/i2400m/usb-fw.c |
| @@ -354,6 +354,7 @@ ssize_t i2400mu_bus_bm_wait_for_ack(struct i2400m *i2400m, |
| usb_autopm_put_interface(i2400mu->usb_iface); |
| d_fnend(8, dev, "(i2400m %p ack %p size %zu) = %ld\n", |
| i2400m, ack, ack_size, (long) result); |
| + usb_put_urb(¬if_urb); |
| return result; |
| |
| error_exceeded: |
| -- |
| 2.20.1 |
| |
