memory leakage in ncm_wrap_ntb() in USB ncm mode with kernel 5.15

Hi,

This is the friendly patch-bot of Greg Kroah-Hartman. You have sent him a patch that has triggered this response. He used to manually respond to these common problems, but in order to save his sanity (he kept writing the same thing over and over, yet to different people), I was created. Hopefully you will not take offence and will fix the problem in your patch and resubmit it so that it can be accepted into the Linux kernel tree.

You are receiving this message because of the following common error(s) as indicated below:

- Your patch did not apply to any known trees that Greg is in control of. Possibly this is because you made it against Linus's tree, not the linux-next tree, which is where all of the development for the next version of the kernel is at. Please refresh your patch against the linux-next tree, or even better yet, the development tree specified in the MAINTAINERS file for the subsystem you are submitting a patch for, and resend it.

- You did not specify a description of why the patch is needed, or possibly, any description at all, in the email body. Please read the section entitled "The canonical patch format" in the kernel file, Documentation/process/submitting-patches.rst for what is needed in order to properly describe the change.

- You did not write a descriptive Subject: for the patch, allowing Greg, and everyone else, to know what this patch is all about. Please read the section entitled "The canonical patch format" in the kernel file, Documentation/process/submitting-patches.rst for what a proper
Subject: line should look like.

- It looks like you did not use your "real" name for the patch on either the Signed-off-by: line, or the From: line (both of which have to match). Please read the kernel file, Documentation/process/submitting-patches.rst for how to do this correctly.

If you wish to discuss this problem further, or you have questions about how to resolve this issue, please feel free to respond to this email and Greg will reply once he has dug out from the pending patches received from other developers.

thanks,

greg k-h's patch email bot

hello:

       In embedded devices with relatively small memory, if the transfer speed of ncm is fast and other programs occupy CPU memory, it is likely that the return value ncm ->skd_tx_data of alloc_skb() is NULL, and the code is likely to enter err. If skb2 is not processed in err, it will cause memory leakage.

Thank you.

[email protected]

From: gregkh
Date: 2024-05-19 22:37
To: [email protected]
CC: balbi; linux-usb; linux-kernel
Subject: Re: memory leakage in ncm_wrap_ntb() in USB ncm mode with kernel 5.15

Hi,

This is the friendly patch-bot of Greg Kroah-Hartman. You have sent him a patch that has triggered this response. He used to manually respond to these common problems, but in order to save his sanity (he kept writing the same thing over and over, yet to different people), I was created. Hopefully you will not take offence and will fix the problem in your patch and resubmit it so that it can be accepted into the Linux kernel tree.

You are receiving this message because of the following common error(s) as indicated below:

- Your patch did not apply to any known trees that Greg is in control of. Possibly this is because you made it against Linus's tree, not the linux-next tree, which is where all of the development for the next version of the kernel is at. Please refresh your patch against the linux-next tree, or even better yet, the development tree specified in the MAINTAINERS file for the subsystem you are submitting a patch for, and resend it.

- You did not specify a description of why the patch is needed, or possibly, any description at all, in the email body. Please read the section entitled "The canonical patch format" in the kernel file, Documentation/process/submitting-patches.rst for what is needed in order to properly describe the change.

- You did not write a descriptive Subject: for the patch, allowing Greg, and everyone else, to know what this patch is all about. Please read the section entitled "The canonical patch format" in the kernel file, Documentation/process/submitting-patches.rst for what a proper
Subject: line should look like.

- It looks like you did not use your "real" name for the patch on either the Signed-off-by: line, or the From: line (both of which have to match). Please read the kernel file, Documentation/process/submitting-patches.rst for how to do this correctly.

If you wish to discuss this problem further, or you have questions about how to resolve this issue, please feel free to respond to this email and Greg will reply once he has dug out from the pending patches received from other developers.

thanks,

greg k-h's patch email bot

From 29d450b3278d5090d8b62f784e993b0eb11eec34 Mon Sep 17 00:00:00 2001
From: nanfengwq <[email protected]>
Date: Sat, 18 May 2024 16:15:45 +0800
Subject: [PATCH] USB(NCM mode):There is a memory leak

If skb2 is not equal to NULL and the return value of allocskb() is NULL,it will cause a memory leak

---
 drivers/usb/gadget/function/f_ncm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index e0c183234..c9bde7afd 100644
@@ -1144,7 +1144,7 @@ static struct sk_buff *ncm_wrap_ntb(struct gether *port,
 	if (ncm->skb_tx_ndp)
 		dev_kfree_skb_any(ncm->skb_tx_ndp);
 
-	return NULL;
+	return skb2;
 }
 
 /*

2.32.0.windows.1

Please do not send html email, the mailing list rejects it :(

Please read how to properly send kernel patches, the in-kernel documentation should be very complete, is there anything there that you do not understand?

thanks,

greg k-h

Hi,

apart from the submission process, could you please explain how this condition may happem?

        if (skb) {

[..]

                if (ncm->skb_tx_data

We know ncm->skb_tx_data != NULL && skb != NULL

                    && (ncm->ndp_dgram_count >= TX_MAX_NUM_DPE
                    || (ncm->skb_tx_data->len +
                    div + rem + skb->len +
                    ncm->skb_tx_ndp->len + ndp_align + (2 * dgram_idx_len))
                    > max_size)) {
                        skb2 = package_for_tx(ncm);


		if (!ncm->skb_tx_data) {

We know ncm->skb_tx_data == NULL && skb != NULL

                        /* Create a new skb for the NTH and datagrams. */
                        ncm->skb_tx_data = alloc_skb(max_size, GFP_ATOMIC);
                        if (!ncm->skb_tx_data)
                                goto err;

It seems to me that either

skb2 = package_for_tx(ncm);

or

ncm->skb_tx_data = alloc_skb(max_size, GFP_ATOMIC);

can be executed. The code paths seem to be mutually exclusive.

Regards
Oliver