]> git.baikalelectronics.ru Git - kernel.git/commit
usbnet: Fix memory leak in usbnet_disconnect()
authorPeilin Ye <peilin.ye@bytedance.com>
Fri, 23 Sep 2022 04:25:51 +0000 (21:25 -0700)
committerJakub Kicinski <kuba@kernel.org>
Mon, 26 Sep 2022 18:23:22 +0000 (11:23 -0700)
commitf6727705bdb817b52306e8f5acebe51084d6e423
treea511ad087e03a07f34980921185d2eae6298c8da
parent2870d4b46c56f6e2d9b1a321b98203912cd3429e
usbnet: Fix memory leak in usbnet_disconnect()

Currently usbnet_disconnect() unanchors and frees all deferred URBs
using usb_scuttle_anchored_urbs(), which does not free urb->context,
causing a memory leak as reported by syzbot.

Use a usb_get_from_anchor() while loop instead, similar to what we did
in commit f30e45bc9791 ("Bluetooth: btusb: Fix memory leak in
play_deferred").  Also free urb->sg.

Reported-and-tested-by: syzbot+dcd3e13cf4472f2e0ba1@syzkaller.appspotmail.com
Fixes: 2385e1758792 ("usbnet & cdc-ether: Autosuspend for online devices")
Fixes: fe944a042720 ("USBNET: support DMA SG")
Signed-off-by: Peilin Ye <peilin.ye@bytedance.com>
Link: https://lore.kernel.org/r/20220923042551.2745-1-yepeilin.cs@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
drivers/net/usb/usbnet.c