On Mon, May 15, 2017 at 05:37:52PM +0200, Michael Grzeschik wrote:
> The usbip stack dynamically allocates the transfer_buffer of each urb in
> stub_recv_cmd_submit depending on the requested transfer_buffer_length
> set via the received tcp packet. As the usbip layer never reuses the
> always different sized transfer_buffer it can always add URB_FREE_BUFFER
> to the urbs transfer_flags and let urb_destroy call the kfree for it.
As this also fixes the double kfree I think this could go into the stable tree.
> Signed-off-by: Michael Grzeschik <m.grzeschik@xxxxxxxxxxxxxx>
> ---
> v1 -> v2: - rephrased patch subject from: "usb: usbip: avoid the usb layer to kfree our allocated buffer"
> - changed from never let urb_destoy remove the transfer_buffer
> to only let urb_destroy remove it
>
>
> drivers/usb/usbip/stub_main.c | 1 -
> drivers/usb/usbip/stub_tx.c | 1 -
> drivers/usb/usbip/usbip_common.c | 8 +++++++-
> 3 files changed, 7 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/usb/usbip/stub_main.c b/drivers/usb/usbip/stub_main.c
> index 44ab43fc4fcc7..898e0d271fd47 100644
> --- a/drivers/usb/usbip/stub_main.c
> +++ b/drivers/usb/usbip/stub_main.c
> @@ -261,7 +261,6 @@ void stub_device_cleanup_urbs(struct stub_device *sdev)
>
> kmem_cache_free(stub_priv_cache, priv);
>
> - kfree(urb->transfer_buffer);
> kfree(urb->setup_packet);
> usb_free_urb(urb);
> }
> diff --git a/drivers/usb/usbip/stub_tx.c b/drivers/usb/usbip/stub_tx.c
> index 6b1e8c3f0e4b2..23d1d76766d2c 100644
> --- a/drivers/usb/usbip/stub_tx.c
> +++ b/drivers/usb/usbip/stub_tx.c
> @@ -28,7 +28,6 @@ static void stub_free_priv_and_urb(struct stub_priv *priv)
> struct urb *urb = priv->urb;
>
> kfree(urb->setup_packet);
> - kfree(urb->transfer_buffer);
> list_del(&priv->list);
> kmem_cache_free(stub_priv_cache, priv);
> usb_free_urb(urb);
> diff --git a/drivers/usb/usbip/usbip_common.c b/drivers/usb/usbip/usbip_common.c
> index cab2b71a80d02..61ae855fb78f7 100644
> --- a/drivers/usb/usbip/usbip_common.c
> +++ b/drivers/usb/usbip/usbip_common.c
> @@ -381,6 +381,12 @@ static unsigned int tweak_transfer_flags(unsigned int flags)
> return flags;
> }
>
> +static unsigned int tweak_submit_transfer_flags(unsigned int flags)
> +{
> + flags |= URB_FREE_BUFFER;
> + return flags;
> +}
> +
> static void usbip_pack_cmd_submit(struct usbip_header *pdu, struct urb *urb,
> int pack)
> {
> @@ -398,7 +404,7 @@ static void usbip_pack_cmd_submit(struct usbip_header *pdu, struct urb *urb,
> spdu->number_of_packets = urb->number_of_packets;
> spdu->interval = urb->interval;
> } else {
> - urb->transfer_flags = spdu->transfer_flags;
> + urb->transfer_flags = tweak_submit_transfer_flags(spdu->transfer_flags);
> urb->transfer_buffer_length = spdu->transfer_buffer_length;
> urb->start_frame = spdu->start_frame;
> urb->number_of_packets = spdu->number_of_packets;
> --
> 2.11.0
>
>
>
--
Pengutronix e.K. | |
Industrial Linux Solutions | http://www.pengutronix.de/ |
Peiner Str. 6-8, 31137 Hildesheim, Germany | Phone: +49-5121-206917-0 |
Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |
--
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
