| From 604acb43f872c071848f3aedb8ad4c1d6a397747 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Tue, 22 Oct 2019 18:30:17 +0900 |
| Subject: usbip: Fix free of unallocated memory in vhci tx |
| |
| From: Suwan Kim <suwan.kim027@gmail.com> |
| |
| [ Upstream commit d4d8257754c3300ea2a465dadf8d2b02c713c920 ] |
| |
| iso_buffer should be set to NULL after use and free in the while loop. |
| In the case of isochronous URB in the while loop, iso_buffer is |
| allocated and after sending it to server, buffer is deallocated. And |
| then, if the next URB in the while loop is not a isochronous pipe, |
| iso_buffer still holds the previously deallocated buffer address and |
| kfree tries to free wrong buffer address. |
| |
| Fixes: ea44d190764b ("usbip: Implement SG support to vhci-hcd and stub driver") |
| Reported-by: kbuild test robot <lkp@intel.com> |
| Reported-by: Julia Lawall <julia.lawall@lip6.fr> |
| Signed-off-by: Suwan Kim <suwan.kim027@gmail.com> |
| Reviewed-by: Julia Lawall <julia.lawall@lip6.fr> |
| Acked-by: Shuah Khan <skhan@linuxfoundation.org> |
| Link: https://lore.kernel.org/r/20191022093017.8027-1-suwan.kim027@gmail.com |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/usb/usbip/vhci_tx.c | 3 +++ |
| 1 file changed, 3 insertions(+) |
| |
| diff --git a/drivers/usb/usbip/vhci_tx.c b/drivers/usb/usbip/vhci_tx.c |
| index 61b1fd379ad2f..acac49402c2b1 100644 |
| --- a/drivers/usb/usbip/vhci_tx.c |
| +++ b/drivers/usb/usbip/vhci_tx.c |
| @@ -147,7 +147,10 @@ static int vhci_send_cmd_submit(struct vhci_device *vdev) |
| } |
| |
| kfree(iov); |
| + /* This is only for isochronous case */ |
| kfree(iso_buffer); |
| + iso_buffer = NULL; |
| + |
| usbip_dbg_vhci_tx("send txdata\n"); |
| |
| total_size += txsize; |
| -- |
| 2.20.1 |
| |
