diff options
| author | David S. Miller | 2020-08-05 17:43:39 -0700 |
|---|---|---|
| committer | David S. Miller | 2020-08-05 17:43:39 -0700 |
| commit | 0063fc3db476d924fa54bc347032b351f28c4b92 (patch) | |
| tree | 2b4aa367b7682896b917857054c52e037b90a2dc | |
| parent | 8ed54f167abda44da48498876953f5b7843378df (diff) | |
| parent | abaf00ff04625275a40e407fc8da04948ae4f95b (diff) | |
Merge branch 'misc-bug-fixes-for-the-hso-driver'
Oliver Neukum says:
====================
misc bug fixes for the hso driver
1. Code reuse led to an unregistration of a net driver that has not been
registered
2. The kernel complains generically if kmalloc with GFP_KERNEL fails
3. A race that can lead to an URB that is in use being reused or
a use after free
====================
Signed-off-by: David S. Miller <davem@davemloft.net>
| -rw-r--r-- | drivers/net/usb/hso.c | 16 |
1 files changed, 7 insertions, 9 deletions
diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c index d2fdb5430d27..2bb28db89432 100644 --- a/drivers/net/usb/hso.c +++ b/drivers/net/usb/hso.c @@ -831,8 +831,7 @@ static void hso_net_tx_timeout(struct net_device *net, unsigned int txqueue) dev_warn(&net->dev, "Tx timed out.\n"); /* Tear the waiting frame off the list */ - if (odev->mux_bulk_tx_urb && - (odev->mux_bulk_tx_urb->status == -EINPROGRESS)) + if (odev->mux_bulk_tx_urb) usb_unlink_urb(odev->mux_bulk_tx_urb); /* Update statistics */ @@ -2357,7 +2356,7 @@ static int remove_net_device(struct hso_device *hso_dev) } /* Frees our network device */ -static void hso_free_net_device(struct hso_device *hso_dev) +static void hso_free_net_device(struct hso_device *hso_dev, bool bailout) { int i; struct hso_net *hso_net = dev2net(hso_dev); @@ -2380,7 +2379,7 @@ static void hso_free_net_device(struct hso_device *hso_dev) kfree(hso_net->mux_bulk_tx_buf); hso_net->mux_bulk_tx_buf = NULL; - if (hso_net->net) + if (hso_net->net && !bailout) free_netdev(hso_net->net); kfree(hso_dev); @@ -2465,10 +2464,9 @@ static void hso_create_rfkill(struct hso_device *hso_dev, &interface_to_usbdev(interface)->dev, RFKILL_TYPE_WWAN, &hso_rfkill_ops, hso_dev); - if (!hso_net->rfkill) { - dev_err(dev, "%s - Out of memory\n", __func__); + if (!hso_net->rfkill) return; - } + if (rfkill_register(hso_net->rfkill) < 0) { rfkill_destroy(hso_net->rfkill); hso_net->rfkill = NULL; @@ -2556,7 +2554,7 @@ static struct hso_device *hso_create_net_device(struct usb_interface *interface, return hso_dev; exit: - hso_free_net_device(hso_dev); + hso_free_net_device(hso_dev, true); return NULL; } @@ -3133,7 +3131,7 @@ static void hso_free_interface(struct usb_interface *interface) rfkill_unregister(rfk); rfkill_destroy(rfk); } - hso_free_net_device(network_table[i]); + hso_free_net_device(network_table[i], false); } } } |