diff mbox series

[B,D,E,F,CVE-2019-19078,SRU,1/1] ath10k: fix memory leak

Message ID 20191206095542.20209-2-po-hsu.lin@canonical.com
State New
Headers show
Series Fix for CVE-2019-19078 | expand

Commit Message

Po-Hsu Lin Dec. 6, 2019, 9:55 a.m. UTC 
From: Navid Emamdoost <navid.emamdoost@gmail.com>

CVE-2019-19078

In ath10k_usb_hif_tx_sg the allocated urb should be released if
usb_submit_urb fails.

Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
(cherry picked from commit b8d17e7d93d2beb89e4f34c59996376b8b544792)
Signed-off-by: Po-Hsu Lin <po-hsu.lin@canonical.com>
---
 drivers/net/wireless/ath/ath10k/usb.c | 1 +
 1 file changed, 1 insertion(+)

Comments

Connor Kuehl Dec. 6, 2019, 9:12 p.m. UTC | #1 
On 12/6/19 1:55 AM, Po-Hsu Lin wrote:
> From: Navid Emamdoost <navid.emamdoost@gmail.com>
> 
> CVE-2019-19078
> 
> In ath10k_usb_hif_tx_sg the allocated urb should be released if
> usb_submit_urb fails.
> 
> Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
> (cherry picked from commit b8d17e7d93d2beb89e4f34c59996376b8b544792)
> Signed-off-by: Po-Hsu Lin <po-hsu.lin@canonical.com>

Acked-by: Connor Kuehl <connor.kuehl@canonical.com>
diff mbox series

Patch

diff --git a/drivers/net/wireless/ath/ath10k/usb.c b/drivers/net/wireless/ath/ath10k/usb.c
index f09a4ad2e9de..f9571beaf7b7 100644
--- a/drivers/net/wireless/ath/ath10k/usb.c
+++ b/drivers/net/wireless/ath/ath10k/usb.c
@@ -446,6 +446,7 @@  static int ath10k_usb_hif_tx_sg(struct ath10k *ar, u8 pipe_id,
 			ath10k_dbg(ar, ATH10K_DBG_USB_BULK,
 				   "usb bulk transmit failed: %d\n", ret);
 			usb_unanchor_urb(urb);
+			usb_free_urb(urb);
 			ret = -EINVAL;
 			goto err_free_urb_to_pipe;
 		}