From b55227d7ca6baef87f79df3a655b8ba9f656b861 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Wed, 10 Nov 2021 09:30:12 +0100 Subject: [PATCH] 4.4-stable patches added patches: usb-hso-fix-error-handling-code-of-hso_create_net_device.patch --- queue-4.4/series | 1 + ...ndling-code-of-hso_create_net_device.patch | 114 ++++++++++++++++++ 2 files changed, 115 insertions(+) create mode 100644 queue-4.4/usb-hso-fix-error-handling-code-of-hso_create_net_device.patch diff --git a/queue-4.4/series b/queue-4.4/series index 001f039e761..e31e4375a99 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -6,3 +6,4 @@ ib-qib-protect-from-buffer-overflow-in-struct-qib_user_sdma_pkt-fields.patch usb-gadget-mark-usb_fsl_qe-broken-on-64-bit.patch usb-storage-add-compatibility-quirk-flags-for-iodd-2531-2541.patch printk-console-allow-to-disable-console-output-by-using-console-or-console-null.patch +usb-hso-fix-error-handling-code-of-hso_create_net_device.patch diff --git a/queue-4.4/usb-hso-fix-error-handling-code-of-hso_create_net_device.patch b/queue-4.4/usb-hso-fix-error-handling-code-of-hso_create_net_device.patch new file mode 100644 index 00000000000..6fb7068cf15 --- /dev/null +++ b/queue-4.4/usb-hso-fix-error-handling-code-of-hso_create_net_device.patch @@ -0,0 +1,114 @@ +From a6ecfb39ba9d7316057cea823b196b734f6b18ca Mon Sep 17 00:00:00 2001 +From: Dongliang Mu +Date: Wed, 14 Jul 2021 17:13:22 +0800 +Subject: usb: hso: fix error handling code of hso_create_net_device + +From: Dongliang Mu + +commit a6ecfb39ba9d7316057cea823b196b734f6b18ca upstream. + +The current error handling code of hso_create_net_device is +hso_free_net_device, no matter which errors lead to. For example, +WARNING in hso_free_net_device [1]. + +Fix this by refactoring the error handling code of +hso_create_net_device by handling different errors by different code. + +[1] https://syzkaller.appspot.com/bug?id=66eff8d49af1b28370ad342787413e35bbe76efe + +Reported-by: syzbot+44d53c7255bb1aea22d2@syzkaller.appspotmail.com +Fixes: 5fcfb6d0bfcd ("hso: fix bailout in error case of probe") +Signed-off-by: Dongliang Mu +Signed-off-by: David S. Miller +Signed-off-by: Lee Jones +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/usb/hso.c | 33 +++++++++++++++++++++++---------- + 1 file changed, 23 insertions(+), 10 deletions(-) + +--- a/drivers/net/usb/hso.c ++++ b/drivers/net/usb/hso.c +@@ -2522,7 +2522,7 @@ static struct hso_device *hso_create_net + hso_net_init); + if (!net) { + dev_err(&interface->dev, "Unable to create ethernet device\n"); +- goto exit; ++ goto err_hso_dev; + } + + hso_net = netdev_priv(net); +@@ -2535,13 +2535,13 @@ static struct hso_device *hso_create_net + USB_DIR_IN); + if (!hso_net->in_endp) { + dev_err(&interface->dev, "Can't find BULK IN endpoint\n"); +- goto exit; ++ goto err_net; + } + hso_net->out_endp = hso_get_ep(interface, USB_ENDPOINT_XFER_BULK, + USB_DIR_OUT); + if (!hso_net->out_endp) { + dev_err(&interface->dev, "Can't find BULK OUT endpoint\n"); +- goto exit; ++ goto err_net; + } + SET_NETDEV_DEV(net, &interface->dev); + SET_NETDEV_DEVTYPE(net, &hso_type); +@@ -2551,21 +2551,21 @@ static struct hso_device *hso_create_net + hso_net->mux_bulk_rx_urb_pool[i] = usb_alloc_urb(0, GFP_KERNEL); + if (!hso_net->mux_bulk_rx_urb_pool[i]) { + dev_err(&interface->dev, "Could not allocate rx urb\n"); +- goto exit; ++ goto err_mux_bulk_rx; + } + hso_net->mux_bulk_rx_buf_pool[i] = kzalloc(MUX_BULK_RX_BUF_SIZE, + GFP_KERNEL); + if (!hso_net->mux_bulk_rx_buf_pool[i]) +- goto exit; ++ goto err_mux_bulk_rx; + } + hso_net->mux_bulk_tx_urb = usb_alloc_urb(0, GFP_KERNEL); + if (!hso_net->mux_bulk_tx_urb) { + dev_err(&interface->dev, "Could not allocate tx urb\n"); +- goto exit; ++ goto err_mux_bulk_rx; + } + hso_net->mux_bulk_tx_buf = kzalloc(MUX_BULK_TX_BUF_SIZE, GFP_KERNEL); + if (!hso_net->mux_bulk_tx_buf) +- goto exit; ++ goto err_free_tx_urb; + + add_net_device(hso_dev); + +@@ -2573,7 +2573,7 @@ static struct hso_device *hso_create_net + result = register_netdev(net); + if (result) { + dev_err(&interface->dev, "Failed to register device\n"); +- goto exit; ++ goto err_free_tx_buf; + } + + hso_log_port(hso_dev); +@@ -2581,8 +2581,21 @@ static struct hso_device *hso_create_net + hso_create_rfkill(hso_dev, interface); + + return hso_dev; +-exit: +- hso_free_net_device(hso_dev); ++ ++err_free_tx_buf: ++ remove_net_device(hso_dev); ++ kfree(hso_net->mux_bulk_tx_buf); ++err_free_tx_urb: ++ usb_free_urb(hso_net->mux_bulk_tx_urb); ++err_mux_bulk_rx: ++ for (i = 0; i < MUX_BULK_RX_BUF_COUNT; i++) { ++ usb_free_urb(hso_net->mux_bulk_rx_urb_pool[i]); ++ kfree(hso_net->mux_bulk_rx_buf_pool[i]); ++ } ++err_net: ++ free_netdev(net); ++err_hso_dev: ++ kfree(hso_dev); + return NULL; + } + -- 2.47.3