Commit d9899318 authored Feb 16, 2023 by Fedor Pchelkin Committed by Greg Kroah-Hartman May 17, 2023

wifi: ath9k: hif_usb: fix memory leak of remain_skbs

[ Upstream commit 7654cc03eb699297130b693ec34e25f77b17c947 ]

hif_dev->remain_skb is allocated and used exclusively in
ath9k_hif_usb_rx_stream(). It is implied that an allocated remain_skb is
processed and subsequently freed (in error paths) only during the next
call of ath9k_hif_usb_rx_stream().

So, if the urbs are deallocated between those two calls due to the device
deinitialization or suspend, it is possible that ath9k_hif_usb_rx_stream()
is not called next time and the allocated remain_skb is leaked. Our local
Syzkaller instance was able to trigger that.

remain_skb makes sense when receiving two consecutive urbs which are
logically linked together, i.e. a specific data field from the first skb
indicates a cached skb to be allocated, memcpy'd with some data and
subsequently processed in the next call to ath9k_hif_usb_rx_stream(). Urbs
deallocation supposedly makes that link irrelevant so we need to free the
cached skb in those cases.

Fix the leak by introducing a function to explicitly free remain_skb (if
it is not NULL) when the rx urbs have been deallocated. remain_skb is NULL
when it has not been allocated at all (hif_dev struct is kzalloced) or
when it has been processed in next call to ath9k_hif_usb_rx_stream().

Found by Linux Verification Center (linuxtesting.org) with Syzkaller.

Fixes: fb9987d0 ("ath9k_htc: Support for AR9271 chipset.")
Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://lore.kernel.org/r/20230216192301.171225-1-pchelkin@ispras.ru

Signed-off-by: Sasha Levin <sashal@kernel.org>

parent 1286c4ce

drivers/net/wireless/ath/ath9k/hif_usb.c

+19 −0

Original line number	Diff line number	Diff line
		@@ -534,6 +534,24 @@ static struct ath9k_htc_hif hif_usb = {
		.send = hif_usb_send,
		};

		/* Need to free remain_skb allocated in ath9k_hif_usb_rx_stream
		* in case ath9k_hif_usb_rx_stream wasn't called next time to
		* process the buffer and subsequently free it.
		*/
		static void ath9k_hif_usb_free_rx_remain_skb(struct hif_device_usb *hif_dev)
		{
		unsigned long flags;

		spin_lock_irqsave(&hif_dev->rx_lock, flags);
		if (hif_dev->remain_skb) {
		dev_kfree_skb_any(hif_dev->remain_skb);
		hif_dev->remain_skb = NULL;
		hif_dev->rx_remain_len = 0;
		RX_STAT_INC(hif_dev, skb_dropped);
		}
		spin_unlock_irqrestore(&hif_dev->rx_lock, flags);
		}

		static void ath9k_hif_usb_rx_stream(struct hif_device_usb *hif_dev,
		struct sk_buff *skb)
		{
		@@ -868,6 +886,7 @@ static int ath9k_hif_usb_alloc_tx_urbs(struct hif_device_usb *hif_dev)
		static void ath9k_hif_usb_dealloc_rx_urbs(struct hif_device_usb *hif_dev)
		{
		usb_kill_anchored_urbs(&hif_dev->rx_submitted);
		ath9k_hif_usb_free_rx_remain_skb(hif_dev);
		}

		static int ath9k_hif_usb_alloc_rx_urbs(struct hif_device_usb *hif_dev)