Commit 5465fc4d authored by Xiaohui Zhang's avatar Xiaohui Zhang Committed by Chen Ridong
Browse files

nfc: nfcmrvl: Fix memory leak in nfcmrvl_play_deferred 

stable inclusion
from stable-v4.19.249
commit 3e7c7df6991ac349f2fa8540047757df666e610f
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP6U3
CVE: CVE-2022-49729

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=3e7c7df6991ac349f2fa8540047757df666e610f



--------------------------------

[ Upstream commit 8a4d4807 ]

Similar to the handling of play_deferred in commit 19cfe912
("Bluetooth: btusb: Fix memory leak in play_deferred"), we thought
a patch might be needed here as well.

Currently usb_submit_urb is called directly to submit deferred tx
urbs after unanchor them.

So the usb_giveback_urb_bh would failed to unref it in usb_unanchor_urb
and cause memory leak.

Put those urbs in tx_anchor to avoid the leak, and also fix the error
handling.

Signed-off-by: default avatarXiaohui Zhang <xiaohuizhang@ruc.edu.cn>
Acked-by: default avatarKrzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Link: https://lore.kernel.org/r/20220607083230.6182-1-xiaohuizhang@ruc.edu.cn


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarChen Ridong <chenridong@huawei.com>
parent 09e19251

drivers/nfc/nfcmrvl/usb.c

+14 −2
Original line number Diff line number Diff line
@@ -401,13 +401,25 @@ static void nfcmrvl_play_deferred(struct nfcmrvl_usb_drv_data *drv_data) 
	int err;



	while ((urb = usb_get_from_anchor(&drv_data->deferred))) {

		usb_anchor_urb(urb, &drv_data->tx_anchor);



		err = usb_submit_urb(urb, GFP_ATOMIC);

		if (err)

		if (err) {

			kfree(urb->setup_packet);

			usb_unanchor_urb(urb);

			usb_free_urb(urb);

			break;

		}



		drv_data->tx_in_flight++;

		usb_free_urb(urb);

	}



	/* Cleanup the rest deferred urbs. */

	while ((urb = usb_get_from_anchor(&drv_data->deferred))) {

		kfree(urb->setup_packet);

		usb_free_urb(urb);

	}

	usb_scuttle_anchored_urbs(&drv_data->deferred);

}



static int nfcmrvl_resume(struct usb_interface *intf)