Unverified Commit 3441ff8f authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!9278 CVE-2021-47231 

Merge Pull Request from: @ci-robot 
 
PR sync from: Zhang Changzhong <zhangchangzhong@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/3UT4AQDD262J5YZKGCWSRKHX26SXESQB/ 
Pavel Skripkin (2):
  can: mcba_usb: fix memory leak in mcba_usb
  can: mcba_usb_start(): add missing urb->transfer_dma initialization


-- 
2.9.5
 
https://gitee.com/src-openeuler/kernel/issues/I9R4I3 
 
Link:https://gitee.com/openeuler/kernel/pulls/9278

 

Reviewed-by: default avatarLiu YongQiang <liuyongqiang13@huawei.com>
Reviewed-by: default avatarYue Haibing <yuehaibing@huawei.com>
Signed-off-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
parents 52feb0ca 14aed3f7

drivers/net/can/usb/mcba_usb.c

+17 −2
Original line number Diff line number Diff line
@@ -93,6 +93,8 @@ struct mcba_priv { 
	bool can_ka_first_pass;

	bool can_speed_check;

	atomic_t free_ctx_cnt;

	void *rxbuf[MCBA_MAX_RX_URBS];

	dma_addr_t rxbuf_dma[MCBA_MAX_RX_URBS];

};



/* CAN frame */
@@ -643,6 +645,7 @@ static int mcba_usb_start(struct mcba_priv *priv) 
	for (i = 0; i < MCBA_MAX_RX_URBS; i++) {

		struct urb *urb = NULL;

		u8 *buf;

		dma_addr_t buf_dma;



		/* create a URB, and a buffer for it */

		urb = usb_alloc_urb(0, GFP_KERNEL);
@@ -652,7 +655,7 @@ static int mcba_usb_start(struct mcba_priv *priv) 
		}



		buf = usb_alloc_coherent(priv->udev, MCBA_USB_RX_BUFF_SIZE,

					 GFP_KERNEL, &urb->transfer_dma);

					 GFP_KERNEL, &buf_dma);

		if (!buf) {

			netdev_err(netdev, "No memory left for USB buffer\n");

			usb_free_urb(urb);
@@ -660,6 +663,8 @@ static int mcba_usb_start(struct mcba_priv *priv) 
			break;

		}



		urb->transfer_dma = buf_dma;



		usb_fill_bulk_urb(urb, priv->udev,

				  usb_rcvbulkpipe(priv->udev, MCBA_USB_EP_IN),

				  buf, MCBA_USB_RX_BUFF_SIZE,
@@ -671,11 +676,14 @@ static int mcba_usb_start(struct mcba_priv *priv) 
		if (err) {

			usb_unanchor_urb(urb);

			usb_free_coherent(priv->udev, MCBA_USB_RX_BUFF_SIZE,

					  buf, urb->transfer_dma);

					  buf, buf_dma);

			usb_free_urb(urb);

			break;

		}



		priv->rxbuf[i] = buf;

		priv->rxbuf_dma[i] = buf_dma;



		/* Drop reference, USB core will take care of freeing it */

		usb_free_urb(urb);

	}
@@ -718,7 +726,14 @@ static int mcba_usb_open(struct net_device *netdev) 


static void mcba_urb_unlink(struct mcba_priv *priv)

{

	int i;



	usb_kill_anchored_urbs(&priv->rx_submitted);



	for (i = 0; i < MCBA_MAX_RX_URBS; ++i)

		usb_free_coherent(priv->udev, MCBA_USB_RX_BUFF_SIZE,

				  priv->rxbuf[i], priv->rxbuf_dma[i]);



	usb_kill_anchored_urbs(&priv->tx_submitted);

}