From 85b2b5448ceae945d46f90e57768a2d6e7db153b Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Sun, 30 May 2021 14:32:46 +0200 Subject: [PATCH] 5.10-stable patches added patches: net-usb-fix-memory-leak-in-smsc75xx_bind.patch --- ...usb-fix-memory-leak-in-smsc75xx_bind.patch | 60 +++++++++++++++++++ queue-5.10/series | 1 + 2 files changed, 61 insertions(+) create mode 100644 queue-5.10/net-usb-fix-memory-leak-in-smsc75xx_bind.patch diff --git a/queue-5.10/net-usb-fix-memory-leak-in-smsc75xx_bind.patch b/queue-5.10/net-usb-fix-memory-leak-in-smsc75xx_bind.patch new file mode 100644 index 00000000000..3e9d1bb846d --- /dev/null +++ b/queue-5.10/net-usb-fix-memory-leak-in-smsc75xx_bind.patch @@ -0,0 +1,60 @@ +From 46a8b29c6306d8bbfd92b614ef65a47c900d8e70 Mon Sep 17 00:00:00 2001 +From: Pavel Skripkin +Date: Mon, 24 May 2021 23:02:08 +0300 +Subject: net: usb: fix memory leak in smsc75xx_bind + +From: Pavel Skripkin + +commit 46a8b29c6306d8bbfd92b614ef65a47c900d8e70 upstream. + +Syzbot reported memory leak in smsc75xx_bind(). +The problem was is non-freed memory in case of +errors after memory allocation. + +backtrace: + [] kmalloc include/linux/slab.h:556 [inline] + [] kzalloc include/linux/slab.h:686 [inline] + [] smsc75xx_bind+0x7a/0x334 drivers/net/usb/smsc75xx.c:1460 + [] usbnet_probe+0x3b6/0xc30 drivers/net/usb/usbnet.c:1728 + +Fixes: d0cad871703b ("smsc75xx: SMSC LAN75xx USB gigabit ethernet adapter driver") +Cc: stable@kernel.vger.org +Reported-and-tested-by: syzbot+b558506ba8165425fee2@syzkaller.appspotmail.com +Signed-off-by: Pavel Skripkin +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/usb/smsc75xx.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/drivers/net/usb/smsc75xx.c ++++ b/drivers/net/usb/smsc75xx.c +@@ -1483,7 +1483,7 @@ static int smsc75xx_bind(struct usbnet * + ret = smsc75xx_wait_ready(dev, 0); + if (ret < 0) { + netdev_warn(dev->net, "device not ready in smsc75xx_bind\n"); +- return ret; ++ goto err; + } + + smsc75xx_init_mac_address(dev); +@@ -1492,7 +1492,7 @@ static int smsc75xx_bind(struct usbnet * + ret = smsc75xx_reset(dev); + if (ret < 0) { + netdev_warn(dev->net, "smsc75xx_reset error %d\n", ret); +- return ret; ++ goto err; + } + + dev->net->netdev_ops = &smsc75xx_netdev_ops; +@@ -1502,6 +1502,10 @@ static int smsc75xx_bind(struct usbnet * + dev->hard_mtu = dev->net->mtu + dev->net->hard_header_len; + dev->net->max_mtu = MAX_SINGLE_PACKET_SIZE; + return 0; ++ ++err: ++ kfree(pdata); ++ return ret; + } + + static void smsc75xx_unbind(struct usbnet *dev, struct usb_interface *intf) diff --git a/queue-5.10/series b/queue-5.10/series index 3468b05ea09..3afe00afd71 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -86,3 +86,4 @@ thermal-drivers-intel-initialize-rw-trip-to-thermal_temp_invalid.patch usb-dwc3-gadget-properly-track-pending-and-queued-sg.patch usb-gadget-udc-renesas_usb3-fix-a-race-in-usb3_start_pipen.patch usb-typec-mux-fix-matching-with-typec_altmode_desc.patch +net-usb-fix-memory-leak-in-smsc75xx_bind.patch -- 2.47.3