Netdev Archive on lore.kernel.org
help / color / mirror / Atom feed
* [RESEND PATCH V3 1/2] usb: hso: fix error handling code of hso_create_net_device
@ 2021-07-21  8:14 Dongliang Mu
  2021-07-21  8:14 ` [RESEND PATCH V3 2/2] usb: hso: remove the bailout parameter Dongliang Mu
  2021-07-21 16:10 ` [RESEND PATCH V3 1/2] usb: hso: fix error handling code of hso_create_net_device patchwork-bot+netdevbpf
  0 siblings, 2 replies; 3+ messages in thread
From: Dongliang Mu @ 2021-07-21  8:14 UTC (permalink / raw)
  To: David S. Miller, Jakub Kicinski, Greg Kroah-Hartman,
	Johan Hovold, Oliver Neukum, Dongliang Mu, Jiri Slaby,
	Emil Renner Berthing, Dan Carpenter, Anirudh Rayabharam
  Cc: syzbot+44d53c7255bb1aea22d2, Rustam Kovhaev, linux-usb, netdev,
	linux-kernel

The current error handling code of hso_create_net_device is
hso_free_net_device, no matter which errors lead to. For example,
WARNING in hso_free_net_device [1].

Fix this by refactoring the error handling code of
hso_create_net_device by handling different errors by different code.

[1] https://syzkaller.appspot.com/bug?id=66eff8d49af1b28370ad342787413e35bbe76efe

Reported-by: syzbot+44d53c7255bb1aea22d2@syzkaller.appspotmail.com
Fixes: 5fcfb6d0bfcd ("hso: fix bailout in error case of probe")
Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com>
---
v1->v2: change labels according to the comment of Dan Carpenter
v2->v3: change the style of error handling labels

 drivers/net/usb/hso.c | 33 +++++++++++++++++++++++----------
 1 file changed, 23 insertions(+), 10 deletions(-)

diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
index 63006838bdcc..dec96e8ab567 100644
--- a/drivers/net/usb/hso.c
+++ b/drivers/net/usb/hso.c
@@ -2495,7 +2495,7 @@ static struct hso_device *hso_create_net_device(struct usb_interface *interface,
 			   hso_net_init);
 	if (!net) {
 		dev_err(&interface->dev, "Unable to create ethernet device\n");
-		goto exit;
+		goto err_hso_dev;
 	}
 
 	hso_net = netdev_priv(net);
@@ -2508,13 +2508,13 @@ static struct hso_device *hso_create_net_device(struct usb_interface *interface,
 				      USB_DIR_IN);
 	if (!hso_net->in_endp) {
 		dev_err(&interface->dev, "Can't find BULK IN endpoint\n");
-		goto exit;
+		goto err_net;
 	}
 	hso_net->out_endp = hso_get_ep(interface, USB_ENDPOINT_XFER_BULK,
 				       USB_DIR_OUT);
 	if (!hso_net->out_endp) {
 		dev_err(&interface->dev, "Can't find BULK OUT endpoint\n");
-		goto exit;
+		goto err_net;
 	}
 	SET_NETDEV_DEV(net, &interface->dev);
 	SET_NETDEV_DEVTYPE(net, &hso_type);
@@ -2523,18 +2523,18 @@ static struct hso_device *hso_create_net_device(struct usb_interface *interface,
 	for (i = 0; i < MUX_BULK_RX_BUF_COUNT; i++) {
 		hso_net->mux_bulk_rx_urb_pool[i] = usb_alloc_urb(0, GFP_KERNEL);
 		if (!hso_net->mux_bulk_rx_urb_pool[i])
-			goto exit;
+			goto err_mux_bulk_rx;
 		hso_net->mux_bulk_rx_buf_pool[i] = kzalloc(MUX_BULK_RX_BUF_SIZE,
 							   GFP_KERNEL);
 		if (!hso_net->mux_bulk_rx_buf_pool[i])
-			goto exit;
+			goto err_mux_bulk_rx;
 	}
 	hso_net->mux_bulk_tx_urb = usb_alloc_urb(0, GFP_KERNEL);
 	if (!hso_net->mux_bulk_tx_urb)
-		goto exit;
+		goto err_mux_bulk_rx;
 	hso_net->mux_bulk_tx_buf = kzalloc(MUX_BULK_TX_BUF_SIZE, GFP_KERNEL);
 	if (!hso_net->mux_bulk_tx_buf)
-		goto exit;
+		goto err_free_tx_urb;
 
 	add_net_device(hso_dev);
 
@@ -2542,7 +2542,7 @@ static struct hso_device *hso_create_net_device(struct usb_interface *interface,
 	result = register_netdev(net);
 	if (result) {
 		dev_err(&interface->dev, "Failed to register device\n");
-		goto exit;
+		goto err_free_tx_buf;
 	}
 
 	hso_log_port(hso_dev);
@@ -2550,8 +2550,21 @@ static struct hso_device *hso_create_net_device(struct usb_interface *interface,
 	hso_create_rfkill(hso_dev, interface);
 
 	return hso_dev;
-exit:
-	hso_free_net_device(hso_dev, true);
+
+err_free_tx_buf:
+	remove_net_device(hso_dev);
+	kfree(hso_net->mux_bulk_tx_buf);
+err_free_tx_urb:
+	usb_free_urb(hso_net->mux_bulk_tx_urb);
+err_mux_bulk_rx:
+	for (i = 0; i < MUX_BULK_RX_BUF_COUNT; i++) {
+		usb_free_urb(hso_net->mux_bulk_rx_urb_pool[i]);
+		kfree(hso_net->mux_bulk_rx_buf_pool[i]);
+	}
+err_net:
+	free_netdev(net);
+err_hso_dev:
+	kfree(hso_dev);
 	return NULL;
 }
 
-- 
2.25.1


^ permalink raw reply	[flat|nested] 3+ messages in thread

* [RESEND PATCH V3 2/2] usb: hso: remove the bailout parameter
  2021-07-21  8:14 [RESEND PATCH V3 1/2] usb: hso: fix error handling code of hso_create_net_device Dongliang Mu
@ 2021-07-21  8:14 ` Dongliang Mu
  2021-07-21 16:10 ` [RESEND PATCH V3 1/2] usb: hso: fix error handling code of hso_create_net_device patchwork-bot+netdevbpf
  1 sibling, 0 replies; 3+ messages in thread
From: Dongliang Mu @ 2021-07-21  8:14 UTC (permalink / raw)
  To: David S. Miller, Jakub Kicinski, Greg Kroah-Hartman,
	Johan Hovold, Oliver Neukum, David Sterba, Jiri Slaby,
	Dongliang Mu, Rustam Kovhaev, Dan Carpenter, Anirudh Rayabharam
  Cc: linux-usb, netdev, linux-kernel

There are two invocation sites of hso_free_net_device. After
refactoring hso_create_net_device, this parameter is useless.
Remove the bailout in the hso_free_net_device and change the invocation
sites of this function.

Signed-off-by: Dongliang Mu <mudongliangabcd@gmail.com>
---
 drivers/net/usb/hso.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
index dec96e8ab567..827d574f764a 100644
--- a/drivers/net/usb/hso.c
+++ b/drivers/net/usb/hso.c
@@ -2353,7 +2353,7 @@ static int remove_net_device(struct hso_device *hso_dev)
 }
 
 /* Frees our network device */
-static void hso_free_net_device(struct hso_device *hso_dev, bool bailout)
+static void hso_free_net_device(struct hso_device *hso_dev)
 {
 	int i;
 	struct hso_net *hso_net = dev2net(hso_dev);
@@ -2376,7 +2376,7 @@ static void hso_free_net_device(struct hso_device *hso_dev, bool bailout)
 	kfree(hso_net->mux_bulk_tx_buf);
 	hso_net->mux_bulk_tx_buf = NULL;
 
-	if (hso_net->net && !bailout)
+	if (hso_net->net)
 		free_netdev(hso_net->net);
 
 	kfree(hso_dev);
@@ -3133,7 +3133,7 @@ static void hso_free_interface(struct usb_interface *interface)
 				rfkill_unregister(rfk);
 				rfkill_destroy(rfk);
 			}
-			hso_free_net_device(network_table[i], false);
+			hso_free_net_device(network_table[i]);
 		}
 	}
 }
-- 
2.25.1


^ permalink raw reply	[flat|nested] 3+ messages in thread

* Re: [RESEND PATCH V3 1/2] usb: hso: fix error handling code of hso_create_net_device
  2021-07-21  8:14 [RESEND PATCH V3 1/2] usb: hso: fix error handling code of hso_create_net_device Dongliang Mu
  2021-07-21  8:14 ` [RESEND PATCH V3 2/2] usb: hso: remove the bailout parameter Dongliang Mu
@ 2021-07-21 16:10 ` patchwork-bot+netdevbpf
  1 sibling, 0 replies; 3+ messages in thread
From: patchwork-bot+netdevbpf @ 2021-07-21 16:10 UTC (permalink / raw)
  To: Dongliang Mu
  Cc: davem, kuba, gregkh, johan, oneukum, jirislaby, kernel,
	dan.carpenter, mail, syzbot+44d53c7255bb1aea22d2, rkovhaev,
	linux-usb, netdev, linux-kernel

Hello:

This series was applied to netdev/net-next.git (refs/heads/master):

On Wed, 21 Jul 2021 16:14:56 +0800 you wrote:
> The current error handling code of hso_create_net_device is
> hso_free_net_device, no matter which errors lead to. For example,
> WARNING in hso_free_net_device [1].
> 
> Fix this by refactoring the error handling code of
> hso_create_net_device by handling different errors by different code.
> 
> [...]

Here is the summary with links:
  - [RESEND,V3,1/2] usb: hso: fix error handling code of hso_create_net_device
    https://git.kernel.org/netdev/net-next/c/788e67f18d79
  - [RESEND,V3,2/2] usb: hso: remove the bailout parameter
    https://git.kernel.org/netdev/net-next/c/dcb713d53e2e

You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html



^ permalink raw reply	[flat|nested] 3+ messages in thread

end of thread, other threads:[~2021-07-21 16:10 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-07-21  8:14 [RESEND PATCH V3 1/2] usb: hso: fix error handling code of hso_create_net_device Dongliang Mu
2021-07-21  8:14 ` [RESEND PATCH V3 2/2] usb: hso: remove the bailout parameter Dongliang Mu
2021-07-21 16:10 ` [RESEND PATCH V3 1/2] usb: hso: fix error handling code of hso_create_net_device patchwork-bot+netdevbpf

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).