Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e9e2ce00 authored by Pavel Skripkin's avatar Pavel Skripkin Committed by Greg Kroah-Hartman
Browse files

can: esd_usb2: fix memory leak 

commit 928150fad41ba16df7fcc9f7f945747d0f56cbb6 upstream.

In esd_usb2_setup_rx_urbs() MAX_RX_URBS coherent buffers are allocated
and there is nothing, that frees them:

1) In callback function the urb is resubmitted and that's all
2) In disconnect function urbs are simply killed, but URB_FREE_BUFFER
   is not set (see esd_usb2_setup_rx_urbs) and this flag cannot be used
   with coherent buffers.

So, all allocated buffers should be freed with usb_free_coherent()
explicitly.

Side note: This code looks like a copy-paste of other can drivers. The
same patch was applied to mcba_usb driver and it works nice with real
hardware. There is no change in functionality, only clean-up code for
coherent buffers.

Fixes: 96d8e903 ("can: Add driver for esd CAN-USB/2 device")
Link: https://lore.kernel.org/r/b31b096926dcb35998ad0271aac4b51770ca7cc8.1627404470.git.paskripkin@gmail.com


Cc: linux-stable <stable@vger.kernel.org>
Signed-off-by: default avatarPavel Skripkin <paskripkin@gmail.com>
Signed-off-by: default avatarMarc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 43726620

drivers/net/can/usb/esd_usb2.c

+15 −1
Original line number Diff line number Diff line
@@ -195,6 +195,8 @@ struct esd_usb2 { 
	int net_count;

	u32 version;

	int rxinitdone;

	void *rxbuf[MAX_RX_URBS];

	dma_addr_t rxbuf_dma[MAX_RX_URBS];

};



struct esd_usb2_net_priv {
@@ -544,6 +546,7 @@ static int esd_usb2_setup_rx_urbs(struct esd_usb2 *dev) 
	for (i = 0; i < MAX_RX_URBS; i++) {

		struct urb *urb = NULL;

		u8 *buf = NULL;

		dma_addr_t buf_dma;



		/* create a URB, and a buffer for it */

		urb = usb_alloc_urb(0, GFP_KERNEL);
@@ -553,7 +556,7 @@ static int esd_usb2_setup_rx_urbs(struct esd_usb2 *dev) 
		}



		buf = usb_alloc_coherent(dev->udev, RX_BUFFER_SIZE, GFP_KERNEL,

					 &urb->transfer_dma);

					 &buf_dma);

		if (!buf) {

			dev_warn(dev->udev->dev.parent,

				 "No memory left for USB buffer\n");
@@ -561,6 +564,8 @@ static int esd_usb2_setup_rx_urbs(struct esd_usb2 *dev) 
			goto freeurb;

		}



		urb->transfer_dma = buf_dma;



		usb_fill_bulk_urb(urb, dev->udev,

				  usb_rcvbulkpipe(dev->udev, 1),

				  buf, RX_BUFFER_SIZE,
@@ -573,8 +578,12 @@ static int esd_usb2_setup_rx_urbs(struct esd_usb2 *dev) 
			usb_unanchor_urb(urb);

			usb_free_coherent(dev->udev, RX_BUFFER_SIZE, buf,

					  urb->transfer_dma);

			goto freeurb;

		}



		dev->rxbuf[i] = buf;

		dev->rxbuf_dma[i] = buf_dma;



freeurb:

		/* Drop reference, USB core will take care of freeing it */

		usb_free_urb(urb);
@@ -662,6 +671,11 @@ static void unlink_all_urbs(struct esd_usb2 *dev) 
	int i, j;



	usb_kill_anchored_urbs(&dev->rx_submitted);



	for (i = 0; i < MAX_RX_URBS; ++i)

		usb_free_coherent(dev->udev, RX_BUFFER_SIZE,

				  dev->rxbuf[i], dev->rxbuf_dma[i]);



	for (i = 0; i < dev->net_count; i++) {

		priv = dev->nets[i];

		if (priv) {