diff mbox series

[5.7,063/120] net: lan78xx: fix transfer-buffer memory leak

Message ID	20200803121905.872450320@linuxfoundation.org
State	New
Headers	show Return-Path: <SRS0=5b7Y=BN=vger.kernel.org=stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, "Woojung.Huh@microchip.com" <Woojung.Huh@microchip.com>, Johan Hovold <johan@kernel.org>, "David S. Miller" <davem@davemloft.net>, Sasha Levin <sashal@kernel.org> Subject: [PATCH 5.7 063/120] net: lan78xx: fix transfer-buffer memory leak Date: Mon, 3 Aug 2020 14:18:41 +0200 Message-Id: <20200803121905.872450320@linuxfoundation.org> In-Reply-To: <20200803121902.860751811@linuxfoundation.org> References: <20200803121902.860751811@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org Precedence: bulk
Series	None \| expand [5.7,004/120] ALSA: hda/realtek: enable headset mic of ASUS ROG Zephyrus G15(GA502) series with A... [5.7,007/120] ALSA: hda/realtek - Fixed HP right speaker no sound [5.7,008/120] ALSA: hda: Workaround for spurious wakeups on some Intel platforms [5.7,009/120] ALSA: hda/hdmi: Fix keep_power assignment for non-component devices [5.7,011/120] IB/rdmavt: Fix RQ counting issues causing use of an invalid RWQE [5.7,012/120] vhost/scsi: fix up req type endian-ness [5.7,014/120] revert: 1320a4052ea1 ("audit: trigger accompanying records when no rules present") [5.7,016/120] ARM: 8987/1: VDSO: Fix incorrect clock_gettime64 [5.7,019/120] ARM: dts: imx6qdl-icore: Fix OTG_ID pin and sdcard detect [5.7,020/120] virtio_balloon: fix up endian-ness for free cmd id [5.7,022/120] ARM: percpu.h: fix build error [5.7,024/120] drm/amd/display: Clear dm_state for fast updates [5.7,025/120] drm/amdgpu: Prevent kernel-infoleak in amdgpu_info_ioctl() [5.7,026/120] drm/dbi: Fix SPI Type 1 (9-bit) transfer [5.7,027/120] drm/mcde: Fix stability issue [5.7,029/120] drm: of: Fix double-free bug [5.7,031/120] random32: remove net_rand_state from the latent entropy gcc plugin [5.7,033/120] libtraceevent: Fix build with binutils 2.35 [5.7,037/120] ARM: dts sunxi: Relax a bit the CMA pool allocation range [5.7,039/120] espintcp: recv() should return 0 when the peer socket is closed [5.7,042/120] nvme-tcp: fix possible hang waiting for icresp response [5.7,043/120] selftests/net: rxtimestamp: fix clang issues for target arch PowerPC [5.7,045/120] selftests/net: so_txtime: fix clang issues for target arch PowerPC [5.7,046/120] selftests/net: tcp_mmap: fix clang warning for target arch PowerPC [5.7,050/120] net: hns3: fix a TX timeout issue [5.7,051/120] net: hns3: add reset check for VF updating port based VLAN [5.7,054/120] net/mlx5: E-switch, Destroy TSAR when fail to enable the mode [5.7,056/120] net/mlx5e: Fix error path of device attach [5.7,057/120] net/mlx5: Fix a bug of using ptp channel index as pin index [5.7,059/120] net/mlx5: Query PPS pin operational status before registering it [5.7,062/120] net: lan78xx: add missing endpoint sanity check [5.7,063/120] net: lan78xx: fix transfer-buffer memory leak [5.7,065/120] mlx4: disable device on shutdown [5.7,067/120] octeontx2-pf: cancel reset_task work [5.7,069/120] bareudp: forbid mixing IP and MPLS in multiproto mode [5.7,071/120] mlxsw: core: Increase scope of RCU read-side critical section [5.7,072/120] mlxsw: core: Free EMAD transactions using kfree_rcu() [5.7,073/120] mlxsw: spectrum_router: Fix use-after-free in router init / de-init [5.7,075/120] ibmvnic: Fix IRQ mapping disposal in error path [5.7,076/120] bpf: Fix map leak in HASH_OF_MAPS map [5.7,079/120] mac80211: mesh: Free pending skb when destroying a mpath [5.7,080/120] RDMA/core: Stop DIM before destroying CQ [5.7,083/120] arm64: csum: Fix handling of bad packets [5.7,086/120] net: nixge: fix potential memory leak in nixge_probe() [5.7,087/120] net: ethernet: mtk_eth_soc: fix MTU warnings [5.7,091/120] net/mlx5e: fix bpf_prog reference count leaks in mlx5e_alloc_rq [5.7,094/120] mt76: mt7615: fix lmac queue debugsfs entry [5.7,095/120] iwlwifi: fix crash in iwl_dbg_tlv_alloc_trigger [5.7,096/120] usb: hso: Fix debug compile warning on sparc32 [5.7,101/120] habanalabs: prevent possible out-of-bounds array access [5.7,103/120] scsi: core: Run queue in case of I/O resource contention failure [5.7,104/120] riscv: kasan: use local_tlb_flush_all() to avoid uninitialized __sbi_rfence [5.7,106/120] net: ethernet: ravb: exit if re-initialization fails in tx timeout [5.7,109/120] i2c: cadence: Clear HOLD bit at correct time in Rx path [5.7,111/120] x86/stacktrace: Fix reliable check for empty user task stacks [5.7,112/120] cxgb4: add missing release on skb in uld_send() [5.7,113/120] xen-netfront: fix potential deadlock in xennet_remove() [5.7,118/120] KVM: LAPIC: Prevent setting the tscdeadline timer if the lapic is hw disabled [5.7,119/120] KVM: SVM: Fix disable pause loop exit/pause filtering capability on SVM

Commit Message

Greg KH Aug. 3, 2020, 12:18 p.m. UTC

From: Johan Hovold <johan@kernel.org>

[ Upstream commit 63634aa679ba8b5e306ad0727120309ae6ba8a8e ]

The interrupt URB transfer-buffer was never freed on disconnect or after
probe errors.

Fixes: 55d7de9de6c3 ("Microchip's LAN7800 family USB 2/3 to 10/100/1000 Ethernet device driver")
Cc: Woojung.Huh@microchip.com <Woojung.Huh@microchip.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/usb/lan78xx.c | 1 +
 1 file changed, 1 insertion(+)

diff mbox series

Patch

diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
index d7162690e3f3d..ee062b27cfa7b 100644
--- a/drivers/net/usb/lan78xx.c
+++ b/drivers/net/usb/lan78xx.c
@@ -3788,6 +3788,7 @@  static int lan78xx_probe(struct usb_interface *intf,
 			usb_fill_int_urb(dev->urb_intr, dev->udev,
 					 dev->pipe_intr, buf, maxp,
 					 intr_complete, dev, period);
+			dev->urb_intr->transfer_flags |= URB_FREE_BUFFER;
 		}
 	}