leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
f3ef38160e
linux/drivers/usb/gadget/legacy
History
Zqiang 129aa97345 usb: raw-gadget: fix memory leak in gadget_setup 
When fetch 'event' from event queue, after copy its address
space content to user space, the 'event' the memory space
pointed to by the 'event' pointer need be freed.

BUG: memory leak
unreferenced object 0xffff888110622660 (size 32):
  comm "softirq", pid 0, jiffies 4294941981 (age 12.480s)
  hex dump (first 32 bytes):
    02 00 00 00 08 00 00 00 80 06 00 01 00 00 40 00  ..............@.
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<00000000efd29abd>] kmalloc include/linux/slab.h:554 [inline]
    [<00000000efd29abd>] raw_event_queue_add drivers/usb/gadget/legacy/raw_gadget.c:66 [inline]
    [<00000000efd29abd>] raw_queue_event drivers/usb/gadget/legacy/raw_gadget.c:225 [inline]
    [<00000000efd29abd>] gadget_setup+0xf6/0x220 drivers/usb/gadget/legacy/raw_gadget.c:343
    [<00000000952c4a46>] dummy_timer+0xb9f/0x14c0 drivers/usb/gadget/udc/dummy_hcd.c:1899
    [<0000000074ac2c54>] call_timer_fn+0x38/0x200 kernel/time/timer.c:1415
    [<00000000560a3a79>] expire_timers kernel/time/timer.c:1460 [inline]
    [<00000000560a3a79>] __run_timers.part.0+0x319/0x400 kernel/time/timer.c:1757
    [<000000009d9503d0>] __run_timers kernel/time/timer.c:1738 [inline]
    [<000000009d9503d0>] run_timer_softirq+0x3d/0x80 kernel/time/timer.c:1770
    [<000000009df27c89>] __do_softirq+0xcc/0x2c2 kernel/softirq.c:298
    [<000000007a3f1a47>] asm_call_irq_on_stack+0xf/0x20
    [<000000004a62cc2e>] __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline]
    [<000000004a62cc2e>] run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline]
    [<000000004a62cc2e>] do_softirq_own_stack+0x32/0x40 arch/x86/kernel/irq_64.c:77
    [<00000000b0086800>] invoke_softirq kernel/softirq.c:393 [inline]
    [<00000000b0086800>] __irq_exit_rcu kernel/softirq.c:423 [inline]
    [<00000000b0086800>] irq_exit_rcu+0x91/0xc0 kernel/softirq.c:435
    [<00000000175f9523>] sysvec_apic_timer_interrupt+0x36/0x80 arch/x86/kernel/apic/apic.c:1091
    [<00000000a348e847>] asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:631
    [<0000000060661100>] native_safe_halt arch/x86/include/asm/irqflags.h:60 [inline]
    [<0000000060661100>] arch_safe_halt arch/x86/include/asm/irqflags.h:103 [inline]
    [<0000000060661100>] acpi_safe_halt drivers/acpi/processor_idle.c:111 [inline]
    [<0000000060661100>] acpi_idle_do_entry+0xc3/0xd0 drivers/acpi/processor_idle.c:517
    [<000000003f413b99>] acpi_idle_enter+0x128/0x1f0 drivers/acpi/processor_idle.c:648
    [<00000000f5e5afb8>] cpuidle_enter_state+0xc9/0x650 drivers/cpuidle/cpuidle.c:237
    [<00000000d50d51fc>] cpuidle_enter+0x29/0x40 drivers/cpuidle/cpuidle.c:351
    [<00000000d674baed>] call_cpuidle kernel/sched/idle.c:132 [inline]
    [<00000000d674baed>] cpuidle_idle_call kernel/sched/idle.c:213 [inline]
    [<00000000d674baed>] do_idle+0x1c8/0x250 kernel/sched/idle.c:273

Reported-by: syzbot+bd38200f53df6259e6bf@syzkaller.appspotmail.com
Signed-off-by: Zqiang <qiang.zhang@windriver.com>
Signed-off-by: Felipe Balbi <balbi@kernel.org>
2020-10-27 11:34:09 +02:00
..
acm_ms.c usb: gadget: Remove set but not used variable 'opts' in acm_ms_do_config 2019-10-22 10:39:01 +03:00
audio.c usb: gadget: audio: Fix a missing error return value in audio_bind() 2020-05-09 11:05:02 +03:00
cdc2.c usb: gadget: legacy: fix error return code in cdc_bind() 2020-05-09 11:05:08 +03:00
dbgp.c USB: add SPDX identifiers to all remaining files in drivers/usb/ 2017-11-04 11:48:02 +01:00
ether.c USB: gadget: legacy: Remove redundant license text 2017-11-07 15:45:02 +01:00
g_ffs.c usb: gadget: legacy: set max_speed to super-speed 2020-01-15 10:39:21 +01:00
gmidi.c usb: gadget: legacy: gmidi: remove useless cast for driver.name 2020-02-19 11:10:24 +01:00
hid.c USB: gadget: legacy: Remove redundant license text 2017-11-07 15:45:02 +01:00
inode.c usb: gadget: Use fallthrough pseudo-keyword 2020-07-10 08:55:18 +02:00
Kconfig usb: get rid of 'choice' for legacy gadget drivers 2020-03-16 08:36:35 +01:00
Makefile usb: gadget: add raw-gadget interface 2020-03-15 11:34:48 +02:00
mass_storage.c usb: gadget: mass_storage: use module_usb_composite_driver to simplify the code 2020-05-25 11:09:40 +03:00
multi.c usb: gadget: legacy: set max_speed to super-speed 2020-01-15 10:39:21 +01:00
ncm.c usb: gadget: legacy: fix error return code in gncm_bind() 2020-05-09 11:05:08 +03:00
nokia.c usb: gadget: legacy: nokia: Remove unused static variable 'product_nokia' 2020-07-09 17:19:56 +02:00
printer.c usb: gadget: legacy: printer: Remove unused variable 'driver_desc' 2020-07-09 17:19:56 +02:00
raw_gadget.c usb: raw-gadget: fix memory leak in gadget_setup 2020-10-27 11:34:09 +02:00
serial.c usb: gadget: legacy/serial: allow dynamic removal 2019-10-22 10:27:15 +03:00
tcm_usb_gadget.c usb: gadget: tcm: fix spelling mistake: "Manufactor" -> "Manufacturer" 2018-07-26 13:35:29 +03:00
webcam.c usb: gadget: uvc: Move trace parameter to function module 2018-07-26 13:33:48 +03:00
zero.c USB: Fix up terminology 2020-07-01 14:04:04 +02:00