Commit 5be7713c authored by Oliver Neukum's avatar Oliver Neukum Committed by Yang Yingliang
Browse files

hso: fix bailout in error case of probe 



mainline inclusion
from mainline-v5.9-rc1
commit 5fcfb6d0
category: bugfix
bugzilla: NA
CVE: CVE-2021-37159

---------------------------

The driver tries to reuse code for disconnect in case
of a failed probe.
If resources need to be freed after an error in probe, the
netdev must not be freed because it has never been registered.
Fix it by telling the helper which path we are in.

Signed-off-by: default avatarOliver Neukum <oneukum@suse.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarYang Yingliang <yangyingliang@huawei.com>
Reviewed-by: default avatarYue Haibing <yuehaibing@huawei.com>
Reviewed-by: default avatarXiu Jianfeng <xiujianfeng@huawei.com>
Signed-off-by: default avatarYang Yingliang <yangyingliang@huawei.com>
parent 3ad0fb1a

drivers/net/usb/hso.c

+4 −4
Original line number Diff line number Diff line
@@ -2366,7 +2366,7 @@ static int remove_net_device(struct hso_device *hso_dev) 
}



/* Frees our network device */

static void hso_free_net_device(struct hso_device *hso_dev)

static void hso_free_net_device(struct hso_device *hso_dev, bool bailout)

{

	int i;

	struct hso_net *hso_net = dev2net(hso_dev);
@@ -2389,7 +2389,7 @@ static void hso_free_net_device(struct hso_device *hso_dev) 
	kfree(hso_net->mux_bulk_tx_buf);

	hso_net->mux_bulk_tx_buf = NULL;



	if (hso_net->net)

	if (hso_net->net && !bailout)

		free_netdev(hso_net->net);



	kfree(hso_dev);
@@ -2565,7 +2565,7 @@ static struct hso_device *hso_create_net_device(struct usb_interface *interface, 


	return hso_dev;

exit:

	hso_free_net_device(hso_dev);

	hso_free_net_device(hso_dev, true);

	return NULL;

}
@@ -3137,7 +3137,7 @@ static void hso_free_interface(struct usb_interface *interface) 
				rfkill_unregister(rfk);

				rfkill_destroy(rfk);

			}

			hso_free_net_device(network_table[i]);

			hso_free_net_device(network_table[i], false);

		}

	}

}