| Message ID | 20191022093017.8027-1-suwan.kim027@gmail.com (mailing list archive) |
|---|---|
| State | Mainlined |
| Commit | d4d8257754c3300ea2a465dadf8d2b02c713c920 |
| Headers | show |
| Series | [v2] usbip: Fix free of unallocated memory in vhci tx | expand |
On Tue, 22 Oct 2019, Suwan Kim wrote: > iso_buffer should be set to NULL after use and free in the while loop. > In the case of isochronous URB in the while loop, iso_buffer is > allocated and after sending it to server, buffer is deallocated. And > then, if the next URB in the while loop is not a isochronous pipe, > iso_buffer still holds the previously deallocated buffer address and > kfree tries to free wrong buffer address. > > Fixes: ea44d190764b ("usbip: Implement SG support to vhci-hcd and stub driver") > Reported-by: kbuild test robot <lkp@intel.com> > Reported-by: Julia Lawall <julia.lawall@lip6.fr> > Signed-off-by: Suwan Kim <suwan.kim027@gmail.com> Reviewed-by: Julia Lawall <julia.lawall@lip6.fr> > --- > v1 - v2: Move the setting NULL after kfree() and add the comment > --- > drivers/usb/usbip/vhci_tx.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/drivers/usb/usbip/vhci_tx.c b/drivers/usb/usbip/vhci_tx.c > index c3803785f6ef..0ae40a13a9fe 100644 > --- a/drivers/usb/usbip/vhci_tx.c > +++ b/drivers/usb/usbip/vhci_tx.c > @@ -147,7 +147,10 @@ static int vhci_send_cmd_submit(struct vhci_device *vdev) > } > > kfree(iov); > + /* This is only for isochronous case */ > kfree(iso_buffer); > + iso_buffer = NULL; > + > usbip_dbg_vhci_tx("send txdata\n"); > > total_size += txsize; > -- > 2.20.1 > >
On 10/22/19 3:51 AM, Julia Lawall wrote: > > > On Tue, 22 Oct 2019, Suwan Kim wrote: > >> iso_buffer should be set to NULL after use and free in the while loop. >> In the case of isochronous URB in the while loop, iso_buffer is >> allocated and after sending it to server, buffer is deallocated. And >> then, if the next URB in the while loop is not a isochronous pipe, >> iso_buffer still holds the previously deallocated buffer address and >> kfree tries to free wrong buffer address. >> >> Fixes: ea44d190764b ("usbip: Implement SG support to vhci-hcd and stub driver") >> Reported-by: kbuild test robot <lkp@intel.com> >> Reported-by: Julia Lawall <julia.lawall@lip6.fr> >> Signed-off-by: Suwan Kim <suwan.kim027@gmail.com> > > Reviewed-by: Julia Lawall <julia.lawall@lip6.fr> > >> --- >> v1 - v2: Move the setting NULL after kfree() and add the comment >> --- Thanks. Acked-by: Shuah Khan <skhan@linuxfoundation.org> thanks, -- Shuah
diff --git a/drivers/usb/usbip/vhci_tx.c b/drivers/usb/usbip/vhci_tx.c index c3803785f6ef..0ae40a13a9fe 100644 --- a/drivers/usb/usbip/vhci_tx.c +++ b/drivers/usb/usbip/vhci_tx.c @@ -147,7 +147,10 @@ static int vhci_send_cmd_submit(struct vhci_device *vdev) } kfree(iov); + /* This is only for isochronous case */ kfree(iso_buffer); + iso_buffer = NULL; + usbip_dbg_vhci_tx("send txdata\n"); total_size += txsize;
iso_buffer should be set to NULL after use and free in the while loop. In the case of isochronous URB in the while loop, iso_buffer is allocated and after sending it to server, buffer is deallocated. And then, if the next URB in the while loop is not a isochronous pipe, iso_buffer still holds the previously deallocated buffer address and kfree tries to free wrong buffer address. Fixes: ea44d190764b ("usbip: Implement SG support to vhci-hcd and stub driver") Reported-by: kbuild test robot <lkp@intel.com> Reported-by: Julia Lawall <julia.lawall@lip6.fr> Signed-off-by: Suwan Kim <suwan.kim027@gmail.com> --- v1 - v2: Move the setting NULL after kfree() and add the comment --- drivers/usb/usbip/vhci_tx.c | 3 +++ 1 file changed, 3 insertions(+)