From patchwork Fri Dec 6 09:55:42 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Po-Hsu Lin X-Patchwork-Id: 1204966 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=none (no SPF record) smtp.mailfrom=lists.ubuntu.com (client-ip=91.189.94.19; helo=huckleberry.canonical.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=) Authentication-Results: ozlabs.org; dmarc=fail (p=none dis=none) header.from=canonical.com Received: from huckleberry.canonical.com (huckleberry.canonical.com [91.189.94.19]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 47TnzX0BHCz9sQp; Fri, 6 Dec 2019 20:56:23 +1100 (AEDT) Received: from localhost ([127.0.0.1] helo=huckleberry.canonical.com) by huckleberry.canonical.com with esmtp (Exim 4.86_2) (envelope-from ) id 1idALU-00076J-Dq; Fri, 06 Dec 2019 09:56:20 +0000 Received: from youngberry.canonical.com ([91.189.89.112]) by huckleberry.canonical.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1idALS-00075g-7R for kernel-team@lists.ubuntu.com; Fri, 06 Dec 2019 09:56:18 +0000 Received: from mail-pl1-f200.google.com ([209.85.214.200]) by youngberry.canonical.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1idALR-0000lb-UY for kernel-team@lists.ubuntu.com; Fri, 06 Dec 2019 09:56:18 +0000 Received: by mail-pl1-f200.google.com with SMTP id be1so3317212plb.1 for ; Fri, 06 Dec 2019 01:56:17 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:subject:date:message-id:in-reply-to :references; bh=YH91GGZh0VnWV/5alkFqorTITVyV78+BD+e9OhariyM=; b=swmxmlf4XUghPHlxFPRi8VW6LurvP+ZmA6PEBMU2sOzIgdI4u22lhKSBmL5A3R6jie odnciFDvCDuMqwDzzMUYmqOFDme8wVVrMc4qvJbnolNDXc//DGMH713nT5dlbBecfZTC uUiwhzHWYfq471uYMEje5GkL9FKh/lF0zFISTxzN80tmEbyqzyb07pOpqSPrkfsI2n5R FSdOmglaGC78NEzRkDRmH+hYqJK/3ckWjEymfId9d26C6+LQOEXAEiN9o6DfF/iY1MgG RWMM9zSX8adHBjJQUuc5qY+BHGkY2OZotZjSGR2FbFiVBG7mNl1pYOVQLlPsB7qPf4rl snlA== X-Gm-Message-State: APjAAAU+hX2gnpOkPQAsyXHVGFPk6tnk6C2GO17mbNMgNZchxyY0Tbz2 eJAGM85CoJEHrbGtShZwDQd/ZQRltfGZMaz1DKOAYq9g25CyvZn0XGdrAjL3iv+546o5kYTNzm9 lkpykZD23ZQhdVLYFBdJ1Cz7dAp1D0GMQqyGCfbWs X-Received: by 2002:a17:902:740c:: with SMTP id g12mr13588609pll.17.1575626176230; Fri, 06 Dec 2019 01:56:16 -0800 (PST) X-Google-Smtp-Source: APXvYqwIc9iYix2DTN7tMMxKxJRnPoySthWjhdsgzwcV35JobaoPj6l5Jq3KrzoLFOWmvSC5egBu/w== X-Received: by 2002:a17:902:740c:: with SMTP id g12mr13588596pll.17.1575626175925; Fri, 06 Dec 2019 01:56:15 -0800 (PST) Received: from Leggiero.taipei.internal (61-220-137-37.HINET-IP.hinet.net. [61.220.137.37]) by smtp.gmail.com with ESMTPSA id b2sm15971653pff.6.2019.12.06.01.56.14 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 06 Dec 2019 01:56:15 -0800 (PST) From: Po-Hsu Lin To: kernel-team@lists.ubuntu.com Subject: [B][D][E][F][CVE-2019-19078][SRU][PATCH 1/1] ath10k: fix memory leak Date: Fri, 6 Dec 2019 17:55:42 +0800 Message-Id: <20191206095542.20209-2-po-hsu.lin@canonical.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20191206095542.20209-1-po-hsu.lin@canonical.com> References: <20191206095542.20209-1-po-hsu.lin@canonical.com> X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" From: Navid Emamdoost CVE-2019-19078 In ath10k_usb_hif_tx_sg the allocated urb should be released if usb_submit_urb fails. Signed-off-by: Navid Emamdoost Signed-off-by: Kalle Valo (cherry picked from commit b8d17e7d93d2beb89e4f34c59996376b8b544792) Signed-off-by: Po-Hsu Lin Acked-by: Connor Kuehl --- drivers/net/wireless/ath/ath10k/usb.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/wireless/ath/ath10k/usb.c b/drivers/net/wireless/ath/ath10k/usb.c index f09a4ad2e9de..f9571beaf7b7 100644 --- a/drivers/net/wireless/ath/ath10k/usb.c +++ b/drivers/net/wireless/ath/ath10k/usb.c @@ -446,6 +446,7 @@ static int ath10k_usb_hif_tx_sg(struct ath10k *ar, u8 pipe_id, ath10k_dbg(ar, ATH10K_DBG_USB_BULK, "usb bulk transmit failed: %d\n", ret); usb_unanchor_urb(urb); + usb_free_urb(urb); ret = -EINVAL; goto err_free_urb_to_pipe; }