Description

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: hif_usb: fix memory leak of urbs in ath9k_hif_usb_dealloc_tx_urbs() Syzkaller reports a long-known leak of urbs in ath9k_hif_usb_dealloc_tx_urbs(). The cause of the leak is that usb_get_urb() is called but usb_free_urb() (or usb_put_urb()) is not called inside usb_kill_urb() as urb->dev or urb->ep fields have not been initialized and usb_kill_urb() returns immediately. The patch removes trying to kill urbs located in hif_dev->tx.tx_buf because hif_dev->tx.tx_buf is not supposed to contain urbs which are in pending state (the pending urbs are stored in hif_dev->tx.tx_pending). The tx.tx_lock is acquired so there should not be any changes in the list. Found by Linux Verification Center (linuxtesting.org) with Syzkaller.

References 9

• git.kernel.org https://git.kernel.org/stable/c/08aa0537ec8cf29ceccae98acc1a534fc12598c1
• git.kernel.org https://git.kernel.org/stable/c/134ae5eba41294eff76e4be20d6001b8f0192207
• git.kernel.org https://git.kernel.org/stable/c/472312fef2b9eccaa03bd59e0ab2527da945e736
• git.kernel.org https://git.kernel.org/stable/c/9850791d389b342ae6e573fe8198db0b4d338352
• git.kernel.org https://git.kernel.org/stable/c/c05189a429fdb371dd455c3c466d67ac2ebff152
• git.kernel.org https://git.kernel.org/stable/c/c2a94de38c74e86f49124ac14f093d6a5c377a90
• git.kernel.org https://git.kernel.org/stable/c/c3fb3e9a2c0c1a0fa492d90eb19bcfa92a5f884d
• git.kernel.org https://git.kernel.org/stable/c/d856f7574bcc1d81de565a857caf32f122cd7ce0
• git.kernel.org https://git.kernel.org/stable/c/eddbb8f7620f9f8008b090a6e10c460074ca575a

Remediation