Home Home > GIT Browse > SLE15
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorTakashi Iwai <tiwai@suse.de>2019-08-18 09:31:56 +0200
committerTakashi Iwai <tiwai@suse.de>2019-08-18 09:32:17 +0200
commitef1229a2217a973c1f760ab2050913c03c4c2e56 (patch)
tree306d4d44bd123e99eca19803deecc12d6eee2c62
parent05fab43be34769bd3fb95076e350922c17f67f07 (diff)
usb: usbfs: fix double-free of usb memory upon submiturb error
(bsc#1051510).
-rw-r--r--patches.drivers/usb-usbfs-fix-double-free-of-usb-memory-upon-submitu.patch39
-rw-r--r--series.conf1
2 files changed, 40 insertions, 0 deletions
diff --git a/patches.drivers/usb-usbfs-fix-double-free-of-usb-memory-upon-submitu.patch b/patches.drivers/usb-usbfs-fix-double-free-of-usb-memory-upon-submitu.patch
new file mode 100644
index 0000000000..ed379a6a97
--- /dev/null
+++ b/patches.drivers/usb-usbfs-fix-double-free-of-usb-memory-upon-submitu.patch
@@ -0,0 +1,39 @@
+From c43f28dfdc4654e738aa6d3fd08a105b2bee758d Mon Sep 17 00:00:00 2001
+From: Gavin Li <git@thegavinli.com>
+Date: Sun, 4 Aug 2019 16:50:44 -0700
+Subject: [PATCH] usb: usbfs: fix double-free of usb memory upon submiturb error
+Git-commit: c43f28dfdc4654e738aa6d3fd08a105b2bee758d
+Patch-mainline: v5.3-rc4
+References: bsc#1051510
+
+Upon an error within proc_do_submiturb(), dec_usb_memory_use_count()
+gets called once by the error handling tail and again by free_async().
+Remove the first call.
+
+Signed-off-by: Gavin Li <git@thegavinli.com>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Cc: stable <stable@vger.kernel.org>
+Link: https://lore.kernel.org/r/20190804235044.22327-1-gavinli@thegavinli.com
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Acked-by: Takashi Iwai <tiwai@suse.de>
+
+---
+ drivers/usb/core/devio.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
+index b265ab5405f9..9063ede411ae 100644
+--- a/drivers/usb/core/devio.c
++++ b/drivers/usb/core/devio.c
+@@ -1812,8 +1812,6 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb
+ return 0;
+
+ error:
+- if (as && as->usbm)
+- dec_usb_memory_use_count(as->usbm, &as->usbm->urb_use_count);
+ kfree(isopkt);
+ kfree(dr);
+ if (as)
+--
+2.16.4
+
diff --git a/series.conf b/series.conf
index f2378d0056..f0c62fed93 100644
--- a/series.conf
+++ b/series.conf
@@ -23393,6 +23393,7 @@
patches.arch/kvm-fix-leak-vcpu-s-vmcs-value-into-other-pcpu
patches.drivers/usb-host-xhci-rcar-Fix-timeout-in-xhci_suspend.patch
patches.drivers/usb-yurex-Fix-use-after-free-in-yurex_delete.patch
+ patches.drivers/usb-usbfs-fix-double-free-of-usb-memory-upon-submitu.patch
patches.drivers/usb-iowarrior-fix-deadlock-on-disconnect.patch
patches.fixes/driver_core-Fix_use-after-free_and_double_free_on_glue.patch
patches.drivers/ALSA-hda-Apply-workaround-for-another-AMD-chip-1022-.patch