diff options
author | Xiyu Yang <xiyuyang19@fudan.edu.cn> | 2020-04-15 16:41:20 +0800 |
---|---|---|
committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2020-05-10 10:30:08 +0200 |
commit | 84a13aebf70fde7ad6c0f72ea777c8bc4257a37e (patch) | |
tree | c1c9b7245701cfd65a89820e01d3b104ac3dbc9b | |
parent | 65d5ea5f20f76ecedcc470df45fe0d92146f8e8e (diff) | |
download | linux-stable-84a13aebf70fde7ad6c0f72ea777c8bc4257a37e.tar.gz linux-stable-84a13aebf70fde7ad6c0f72ea777c8bc4257a37e.tar.bz2 linux-stable-84a13aebf70fde7ad6c0f72ea777c8bc4257a37e.zip |
wimax/i2400m: Fix potential urb refcnt leak
[ Upstream commit 7717cbec172c3554d470023b4020d5781961187e ]
i2400mu_bus_bm_wait_for_ack() invokes usb_get_urb(), which increases the
refcount of the "notif_urb".
When i2400mu_bus_bm_wait_for_ack() returns, local variable "notif_urb"
becomes invalid, so the refcount should be decreased to keep refcount
balanced.
The issue happens in all paths of i2400mu_bus_bm_wait_for_ack(), which
forget to decrease the refcnt increased by usb_get_urb(), causing a
refcnt leak.
Fix this issue by calling usb_put_urb() before the
i2400mu_bus_bm_wait_for_ack() returns.
Signed-off-by: Xiyu Yang <xiyuyang19@fudan.edu.cn>
Signed-off-by: Xin Tan <tanxin.ctf@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
-rw-r--r-- | drivers/net/wimax/i2400m/usb-fw.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/drivers/net/wimax/i2400m/usb-fw.c b/drivers/net/wimax/i2400m/usb-fw.c index 529ebca1e9e1..1f7709d24f35 100644 --- a/drivers/net/wimax/i2400m/usb-fw.c +++ b/drivers/net/wimax/i2400m/usb-fw.c @@ -354,6 +354,7 @@ out: usb_autopm_put_interface(i2400mu->usb_iface); d_fnend(8, dev, "(i2400m %p ack %p size %zu) = %ld\n", i2400m, ack, ack_size, (long) result); + usb_put_urb(¬if_urb); return result; error_exceeded: |