| Message ID | 20201204085519.20230-1-johan@kernel.org (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 3f203f057edfcf6bd02c6b942799262bfcf31f73 |
| Headers | show |
| Series | USB: serial: kl5kusb105: fix memleak on open | expand |
On Fri, Dec 04, 2020 at 09:55:19AM +0100, Johan Hovold wrote: > Fix memory leak of control-message transfer buffer on successful open(). > > Fixes: 6774d5f53271 ("USB: serial: kl5kusb105: fix open error path") > Cc: stable@vger.kernel.org > Signed-off-by: Johan Hovold <johan@kernel.org> > --- > > While reviewing Himadri's control-message series I noticed we have a > related bug in klsi_105_open() that needs fixing. > > > drivers/usb/serial/kl5kusb105.c | 10 ++++------ > 1 file changed, 4 insertions(+), 6 deletions(-) > > diff --git a/drivers/usb/serial/kl5kusb105.c b/drivers/usb/serial/kl5kusb105.c > index 5ee48b0650c4..5f6b82ebccc5 100644 > --- a/drivers/usb/serial/kl5kusb105.c > +++ b/drivers/usb/serial/kl5kusb105.c > @@ -276,12 +276,12 @@ static int klsi_105_open(struct tty_struct *tty, struct usb_serial_port *port) > priv->cfg.unknown2 = cfg->unknown2; > spin_unlock_irqrestore(&priv->lock, flags); > > + kfree(cfg); > + > /* READ_ON and urb submission */ > rc = usb_serial_generic_open(tty, port); > - if (rc) { > - retval = rc; > - goto err_free_cfg; > - } > + if (rc) > + return rc; > > rc = usb_control_msg(port->serial->dev, > usb_sndctrlpipe(port->serial->dev, 0), > @@ -324,8 +324,6 @@ static int klsi_105_open(struct tty_struct *tty, struct usb_serial_port *port) > KLSI_TIMEOUT); > err_generic_close: > usb_serial_generic_close(port); > -err_free_cfg: > - kfree(cfg); > > return retval; > } I've applied this one now so that I can include it in my pull-request for -rc7. Greg, just let me know if you think I should hold this one off for 5.11 instead. Johan
On Fri, Dec 04, 2020 at 12:06:38PM +0100, Johan Hovold wrote: > On Fri, Dec 04, 2020 at 09:55:19AM +0100, Johan Hovold wrote: > > Fix memory leak of control-message transfer buffer on successful open(). > > > > Fixes: 6774d5f53271 ("USB: serial: kl5kusb105: fix open error path") > > Cc: stable@vger.kernel.org > > Signed-off-by: Johan Hovold <johan@kernel.org> > > --- > > > > While reviewing Himadri's control-message series I noticed we have a > > related bug in klsi_105_open() that needs fixing. > > > > > > drivers/usb/serial/kl5kusb105.c | 10 ++++------ > > 1 file changed, 4 insertions(+), 6 deletions(-) > > > > diff --git a/drivers/usb/serial/kl5kusb105.c b/drivers/usb/serial/kl5kusb105.c > > index 5ee48b0650c4..5f6b82ebccc5 100644 > > --- a/drivers/usb/serial/kl5kusb105.c > > +++ b/drivers/usb/serial/kl5kusb105.c > > @@ -276,12 +276,12 @@ static int klsi_105_open(struct tty_struct *tty, struct usb_serial_port *port) > > priv->cfg.unknown2 = cfg->unknown2; > > spin_unlock_irqrestore(&priv->lock, flags); > > > > + kfree(cfg); > > + > > /* READ_ON and urb submission */ > > rc = usb_serial_generic_open(tty, port); > > - if (rc) { > > - retval = rc; > > - goto err_free_cfg; > > - } > > + if (rc) > > + return rc; > > > > rc = usb_control_msg(port->serial->dev, > > usb_sndctrlpipe(port->serial->dev, 0), > > @@ -324,8 +324,6 @@ static int klsi_105_open(struct tty_struct *tty, struct usb_serial_port *port) > > KLSI_TIMEOUT); > > err_generic_close: > > usb_serial_generic_close(port); > > -err_free_cfg: > > - kfree(cfg); > > > > return retval; > > } > > I've applied this one now so that I can include it in my pull-request > for -rc7. > > Greg, just let me know if you think I should hold this one off for 5.11 > instead. Nope, it's fine to take this now, thanks. greg k-h
diff --git a/drivers/usb/serial/kl5kusb105.c b/drivers/usb/serial/kl5kusb105.c index 5ee48b0650c4..5f6b82ebccc5 100644 --- a/drivers/usb/serial/kl5kusb105.c +++ b/drivers/usb/serial/kl5kusb105.c @@ -276,12 +276,12 @@ static int klsi_105_open(struct tty_struct *tty, struct usb_serial_port *port) priv->cfg.unknown2 = cfg->unknown2; spin_unlock_irqrestore(&priv->lock, flags); + kfree(cfg); + /* READ_ON and urb submission */ rc = usb_serial_generic_open(tty, port); - if (rc) { - retval = rc; - goto err_free_cfg; - } + if (rc) + return rc; rc = usb_control_msg(port->serial->dev, usb_sndctrlpipe(port->serial->dev, 0), @@ -324,8 +324,6 @@ static int klsi_105_open(struct tty_struct *tty, struct usb_serial_port *port) KLSI_TIMEOUT); err_generic_close: usb_serial_generic_close(port); -err_free_cfg: - kfree(cfg); return retval; }
Fix memory leak of control-message transfer buffer on successful open(). Fixes: 6774d5f53271 ("USB: serial: kl5kusb105: fix open error path") Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold <johan@kernel.org> --- While reviewing Himadri's control-message series I noticed we have a related bug in klsi_105_open() that needs fixing. drivers/usb/serial/kl5kusb105.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-)