xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

can: ems_usb: fix memory leak

Browse Source 
commit 9969e3c5f40c166e3396acc36c34f9de502929f6 upstream.

In ems_usb_start() MAX_RX_URBS coherent buffers are allocated and
there is nothing, that frees them:

1) In callback function the urb is resubmitted and that's all
2) In disconnect function urbs are simply killed, but URB_FREE_BUFFER
   is not set (see ems_usb_start) and this flag cannot be used with
   coherent buffers.

So, all allocated buffers should be freed with usb_free_coherent()
explicitly.

Side note: This code looks like a copy-paste of other can drivers. The
same patch was applied to mcba_usb driver and it works nice with real
hardware. There is no change in functionality, only clean-up code for
coherent buffers.

Fixes: 702171adee ("ems_usb: Added support for EMS CPC-USB/ARM7 CAN/USB interface")
Link: https://lore.kernel.org/r/59aa9fbc9a8cbf9af2bbd2f61a659c480b415800.1627404470.git.paskripkin@gmail.com
Cc: linux-stable <stable@vger.kernel.org>
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Pavel Skripkin
2021-07-27 20:00:33 +03:00
committed by Greg Kroah-Hartman
parent f58ac91ff8
commit 88b4025816
1 changed files with 13 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
drivers/net/can/usb/ems_usb.c
View File

@@ -255,6 +255,8 @@ struct ems_usb {
unsigned int free_slots; /* remember number of available slots */ unsigned int free_slots; /* remember number of available slots */
struct ems_cpc_msg active_params; /* active controller parameters */ struct ems_cpc_msg active_params; /* active controller parameters */
void *rxbuf[MAX_RX_URBS];
dma_addr_t rxbuf_dma[MAX_RX_URBS];
}; };
static void ems_usb_read_interrupt_callback(struct urb *urb) static void ems_usb_read_interrupt_callback(struct urb *urb)
@@ -587,6 +589,7 @@ static int ems_usb_start(struct ems_usb *dev)
for (i = 0; i < MAX_RX_URBS; i++) { for (i = 0; i < MAX_RX_URBS; i++) {
struct urb *urb = NULL; struct urb *urb = NULL;
u8 *buf = NULL; u8 *buf = NULL;
dma_addr_t buf_dma;
/* create a URB, and a buffer for it */ /* create a URB, and a buffer for it */
urb = usb_alloc_urb(0, GFP_KERNEL); urb = usb_alloc_urb(0, GFP_KERNEL);
@@ -596,7 +599,7 @@ static int ems_usb_start(struct ems_usb *dev)
} }
buf = usb_alloc_coherent(dev->udev, RX_BUFFER_SIZE, GFP_KERNEL, buf = usb_alloc_coherent(dev->udev, RX_BUFFER_SIZE, GFP_KERNEL,
&urb->transfer_dma); &buf_dma);
if (!buf) { if (!buf) {
netdev_err(netdev, "No memory left for USB buffer\n"); netdev_err(netdev, "No memory left for USB buffer\n");
usb_free_urb(urb); usb_free_urb(urb);
@@ -604,6 +607,8 @@ static int ems_usb_start(struct ems_usb *dev)
break; break;
} }
urb->transfer_dma = buf_dma;
usb_fill_bulk_urb(urb, dev->udev, usb_rcvbulkpipe(dev->udev, 2), usb_fill_bulk_urb(urb, dev->udev, usb_rcvbulkpipe(dev->udev, 2),
buf, RX_BUFFER_SIZE, buf, RX_BUFFER_SIZE,
ems_usb_read_bulk_callback, dev); ems_usb_read_bulk_callback, dev);
@@ -619,6 +624,9 @@ static int ems_usb_start(struct ems_usb *dev)
break; break;
} }
dev->rxbuf[i] = buf;
dev->rxbuf_dma[i] = buf_dma;
/* Drop reference, USB core will take care of freeing it */ /* Drop reference, USB core will take care of freeing it */
usb_free_urb(urb); usb_free_urb(urb);
} }
@@ -684,6 +692,10 @@ static void unlink_all_urbs(struct ems_usb *dev)
usb_kill_anchored_urbs(&dev->rx_submitted); usb_kill_anchored_urbs(&dev->rx_submitted);
for (i = 0; i < MAX_RX_URBS; ++i)
usb_free_coherent(dev->udev, RX_BUFFER_SIZE,
dev->rxbuf[i], dev->rxbuf_dma[i]);
usb_kill_anchored_urbs(&dev->tx_submitted); usb_kill_anchored_urbs(&dev->tx_submitted);
atomic_set(&dev->active_tx_urbs, 0); atomic_set(&dev->active_tx_urbs, 0);