summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorDavid S. Miller <davem@davemloft.net>2020-08-06 03:43:39 +0300
committerDavid S. Miller <davem@davemloft.net>2020-08-06 03:43:39 +0300
commit0063fc3db476d924fa54bc347032b351f28c4b92 (patch)
tree2b4aa367b7682896b917857054c52e037b90a2dc
parent8ed54f167abda44da48498876953f5b7843378df (diff)
parentabaf00ff04625275a40e407fc8da04948ae4f95b (diff)
downloadlinux-0063fc3db476d924fa54bc347032b351f28c4b92.tar.xz
Merge branch 'misc-bug-fixes-for-the-hso-driver'
Oliver Neukum says: ==================== misc bug fixes for the hso driver 1. Code reuse led to an unregistration of a net driver that has not been registered 2. The kernel complains generically if kmalloc with GFP_KERNEL fails 3. A race that can lead to an URB that is in use being reused or a use after free ==================== Signed-off-by: David S. Miller <davem@davemloft.net>
-rw-r--r--drivers/net/usb/hso.c16
1 files changed, 7 insertions, 9 deletions
diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
index d2fdb5430d27..2bb28db89432 100644
--- a/drivers/net/usb/hso.c
+++ b/drivers/net/usb/hso.c
@@ -831,8 +831,7 @@ static void hso_net_tx_timeout(struct net_device *net, unsigned int txqueue)
dev_warn(&net->dev, "Tx timed out.\n");
/* Tear the waiting frame off the list */
- if (odev->mux_bulk_tx_urb &&
- (odev->mux_bulk_tx_urb->status == -EINPROGRESS))
+ if (odev->mux_bulk_tx_urb)
usb_unlink_urb(odev->mux_bulk_tx_urb);
/* Update statistics */
@@ -2357,7 +2356,7 @@ static int remove_net_device(struct hso_device *hso_dev)
}
/* Frees our network device */
-static void hso_free_net_device(struct hso_device *hso_dev)
+static void hso_free_net_device(struct hso_device *hso_dev, bool bailout)
{
int i;
struct hso_net *hso_net = dev2net(hso_dev);
@@ -2380,7 +2379,7 @@ static void hso_free_net_device(struct hso_device *hso_dev)
kfree(hso_net->mux_bulk_tx_buf);
hso_net->mux_bulk_tx_buf = NULL;
- if (hso_net->net)
+ if (hso_net->net && !bailout)
free_netdev(hso_net->net);
kfree(hso_dev);
@@ -2465,10 +2464,9 @@ static void hso_create_rfkill(struct hso_device *hso_dev,
&interface_to_usbdev(interface)->dev,
RFKILL_TYPE_WWAN,
&hso_rfkill_ops, hso_dev);
- if (!hso_net->rfkill) {
- dev_err(dev, "%s - Out of memory\n", __func__);
+ if (!hso_net->rfkill)
return;
- }
+
if (rfkill_register(hso_net->rfkill) < 0) {
rfkill_destroy(hso_net->rfkill);
hso_net->rfkill = NULL;
@@ -2556,7 +2554,7 @@ static struct hso_device *hso_create_net_device(struct usb_interface *interface,
return hso_dev;
exit:
- hso_free_net_device(hso_dev);
+ hso_free_net_device(hso_dev, true);
return NULL;
}
@@ -3133,7 +3131,7 @@ static void hso_free_interface(struct usb_interface *interface)
rfkill_unregister(rfk);
rfkill_destroy(rfk);
}
- hso_free_net_device(network_table[i]);
+ hso_free_net_device(network_table[i], false);
}
}
}