Unverified Commit 471243f2 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!5359 CVE-2021-47121 and CVE-2021-47122 

Merge Pull Request from: @ci-robot 
 
PR sync from: Liu Jian <liujian56@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/SBGNHMEZHYZJ7H2XG35Y7PPEBPGY2EVK/ 
CVE-2021-47121 and CVE-2021-47122

Pavel Skripkin (4):
  net: caif: added cfserl_release function
  net: caif: add proper error handling
  net: caif: fix memory leak in cfusbl_device_notify
  net: caif: fix memory leak in caif_device_notify


-- 
2.34.1
 
https://gitee.com/src-openeuler/kernel/issues/I990B2
https://gitee.com/src-openeuler/kernel/issues/I990A7 
 
Link:https://gitee.com/openeuler/kernel/pulls/5359

 

Reviewed-by: default avatarLiu YongQiang <liuyongqiang13@huawei.com>
Reviewed-by: default avatarYue Haibing <yuehaibing@huawei.com>
Signed-off-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
parents be4b2580 50e871d7

include/net/caif/caif_dev.h

+1 −1
Original line number Diff line number Diff line
@@ -119,7 +119,7 @@ void caif_free_client(struct cflayer *adap_layer); 
 * The link_support layer is used to add any Link Layer specific

 * framing.

 */

void caif_enroll_dev(struct net_device *dev, struct caif_dev_common *caifdev,

int caif_enroll_dev(struct net_device *dev, struct caif_dev_common *caifdev,

			struct cflayer *link_support, int head_room,

			struct cflayer **layer, int (**rcv_func)(

				struct sk_buff *, struct net_device *,

include/net/caif/cfcnfg.h

+1 −1
Original line number Diff line number Diff line
@@ -62,7 +62,7 @@ void cfcnfg_remove(struct cfcnfg *cfg); 
 * @fcs:	Specify if checksum is used in CAIF Framing Layer.

 * @head_room:	Head space needed by link specific protocol.

 */

void

int

cfcnfg_add_phy_layer(struct cfcnfg *cnfg,

		     struct net_device *dev, struct cflayer *phy_layer,

		     enum cfcnfg_phy_preference pref,

include/net/caif/cfserl.h

+1 −0
Original line number Diff line number Diff line
@@ -9,4 +9,5 @@ 
#include <net/caif/caif_layer.h>



struct cflayer *cfserl_create(int instance, bool use_stx);

void cfserl_release(struct cflayer *layer);

#endif

net/caif/caif_dev.c

+9 −4
Original line number Diff line number Diff line
@@ -303,7 +303,7 @@ static void dev_flowctrl(struct net_device *dev, int on) 
	caifd_put(caifd);

}



void caif_enroll_dev(struct net_device *dev, struct caif_dev_common *caifdev,

int caif_enroll_dev(struct net_device *dev, struct caif_dev_common *caifdev,

		     struct cflayer *link_support, int head_room,

		     struct cflayer **layer,

		     int (**rcv_func)(struct sk_buff *, struct net_device *,
@@ -314,11 +314,12 @@ void caif_enroll_dev(struct net_device *dev, struct caif_dev_common *caifdev, 
	enum cfcnfg_phy_preference pref;

	struct cfcnfg *cfg = get_cfcnfg(dev_net(dev));

	struct caif_device_entry_list *caifdevs;

	int res;



	caifdevs = caif_device_list(dev_net(dev));

	caifd = caif_device_alloc(dev);

	if (!caifd)

		return;

		return -ENOMEM;

	*layer = &caifd->layer;

	spin_lock_init(&caifd->flow_lock);
@@ -339,7 +340,7 @@ void caif_enroll_dev(struct net_device *dev, struct caif_dev_common *caifdev, 
	strlcpy(caifd->layer.name, dev->name,

		sizeof(caifd->layer.name));

	caifd->layer.transmit = transmit;

	cfcnfg_add_phy_layer(cfg,

	res = cfcnfg_add_phy_layer(cfg,

				dev,

				&caifd->layer,

				pref,
@@ -349,6 +350,7 @@ void caif_enroll_dev(struct net_device *dev, struct caif_dev_common *caifdev, 
	mutex_unlock(&caifdevs->lock);

	if (rcv_func)

		*rcv_func = receive;

	return res;

}

EXPORT_SYMBOL(caif_enroll_dev);
@@ -363,6 +365,7 @@ static int caif_device_notify(struct notifier_block *me, unsigned long what, 
	struct cflayer *layer, *link_support;

	int head_room = 0;

	struct caif_device_entry_list *caifdevs;

	int res;



	cfg = get_cfcnfg(dev_net(dev));

	caifdevs = caif_device_list(dev_net(dev));
@@ -388,8 +391,10 @@ static int caif_device_notify(struct notifier_block *me, unsigned long what, 
				break;

			}

		}

		caif_enroll_dev(dev, caifdev, link_support, head_room,

		res = caif_enroll_dev(dev, caifdev, link_support, head_room,

				&layer, NULL);

		if (res)

			cfserl_release(link_support);

		caifdev->flowctrl = dev_flowctrl;

		break;

net/caif/caif_usb.c

+13 −1
Original line number Diff line number Diff line
@@ -116,6 +116,11 @@ static struct cflayer *cfusbl_create(int phyid, u8 ethaddr[ETH_ALEN], 
	return (struct cflayer *) this;

}



static void cfusbl_release(struct cflayer *layer)

{

	kfree(layer);

}



static struct packet_type caif_usb_type __read_mostly = {

	.type = cpu_to_be16(ETH_P_802_EX1),

};
@@ -128,6 +133,7 @@ static int cfusbl_device_notify(struct notifier_block *me, unsigned long what, 
	struct cflayer *layer, *link_support;

	struct usbnet *usbnet;

	struct usb_device *usbdev;

	int res;



	/* Check whether we have a NCM device, and find its VID/PID. */

	if (!(dev->dev.parent && dev->dev.parent->driver &&
@@ -170,8 +176,11 @@ static int cfusbl_device_notify(struct notifier_block *me, unsigned long what, 
	if (dev->num_tx_queues > 1)

		pr_warn("USB device uses more than one tx queue\n");



	caif_enroll_dev(dev, &common, link_support, CFUSB_MAX_HEADLEN,

	res = caif_enroll_dev(dev, &common, link_support, CFUSB_MAX_HEADLEN,

			&layer, &caif_usb_type.func);

	if (res)

		goto err;



	if (!pack_added)

		dev_add_pack(&caif_usb_type);

	pack_added = true;
@@ -179,6 +188,9 @@ static int cfusbl_device_notify(struct notifier_block *me, unsigned long what, 
	strlcpy(layer->name, dev->name, sizeof(layer->name));



	return 0;

err:

	cfusbl_release(link_support);

	return res;

}



static struct notifier_block caif_device_notifier = {