lkml.org 
[lkml]   [2018]   [Oct]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.4 092/113] usb: gadget: fotg210-udc: Fix memory leak of fotg210->ep[i]
    Date
    4.4-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Anton Vasilyev <vasilyev@ispras.ru>

    [ Upstream commit c37bd52836296ecc9a0fc8060b819089aebdbcde ]

    There is no deallocation of fotg210->ep[i] elements, allocated at
    fotg210_udc_probe.

    The patch adds deallocation of fotg210->ep array elements and simplifies
    error path of fotg210_udc_probe().

    Found by Linux Driver Verification project (linuxtesting.org).

    Signed-off-by: Anton Vasilyev <vasilyev@ispras.ru>
    Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/usb/gadget/udc/fotg210-udc.c | 15 ++++++++++-----
    1 file changed, 10 insertions(+), 5 deletions(-)

    --- a/drivers/usb/gadget/udc/fotg210-udc.c
    +++ b/drivers/usb/gadget/udc/fotg210-udc.c
    @@ -1066,12 +1066,15 @@ static struct usb_gadget_ops fotg210_gad
    static int fotg210_udc_remove(struct platform_device *pdev)
    {
    struct fotg210_udc *fotg210 = platform_get_drvdata(pdev);
    + int i;

    usb_del_gadget_udc(&fotg210->gadget);
    iounmap(fotg210->reg);
    free_irq(platform_get_irq(pdev, 0), fotg210);

    fotg210_ep_free_request(&fotg210->ep[0]->ep, fotg210->ep0_req);
    + for (i = 0; i < FOTG210_MAX_NUM_EP; i++)
    + kfree(fotg210->ep[i]);
    kfree(fotg210);

    return 0;
    @@ -1102,7 +1105,7 @@ static int fotg210_udc_probe(struct plat
    /* initialize udc */
    fotg210 = kzalloc(sizeof(struct fotg210_udc), GFP_KERNEL);
    if (fotg210 == NULL)
    - goto err_alloc;
    + goto err;

    for (i = 0; i < FOTG210_MAX_NUM_EP; i++) {
    _ep[i] = kzalloc(sizeof(struct fotg210_ep), GFP_KERNEL);
    @@ -1114,7 +1117,7 @@ static int fotg210_udc_probe(struct plat
    fotg210->reg = ioremap(res->start, resource_size(res));
    if (fotg210->reg == NULL) {
    pr_err("ioremap error.\n");
    - goto err_map;
    + goto err_alloc;
    }

    spin_lock_init(&fotg210->lock);
    @@ -1162,7 +1165,7 @@ static int fotg210_udc_probe(struct plat
    fotg210->ep0_req = fotg210_ep_alloc_request(&fotg210->ep[0]->ep,
    GFP_KERNEL);
    if (fotg210->ep0_req == NULL)
    - goto err_req;
    + goto err_map;

    fotg210_init(fotg210);

    @@ -1190,12 +1193,14 @@ err_req:
    fotg210_ep_free_request(&fotg210->ep[0]->ep, fotg210->ep0_req);

    err_map:
    - if (fotg210->reg)
    - iounmap(fotg210->reg);
    + iounmap(fotg210->reg);

    err_alloc:
    + for (i = 0; i < FOTG210_MAX_NUM_EP; i++)
    + kfree(fotg210->ep[i]);
    kfree(fotg210);

    +err:
    return ret;
    }


    \
     
     \ /
      Last update: 2018-10-08 21:16    [W:4.146 / U:0.016 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site