lkml.org 
[lkml]   [2020]   [Jul]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.4 087/138] usb: gadget: udc: gr_udc: fix memleak on error handling path in gr_ep_init()
    Date
    From: Evgeny Novikov <novikov@ispras.ru>

    [ Upstream commit c8f8529e2c4141afa2ebb487ad48e8a6ec3e8c99 ]

    gr_ep_init() does not assign the allocated request anywhere if allocation
    of memory for the buffer fails. This is a memory leak fixed by the given
    patch.

    Found by Linux Driver Verification project (linuxtesting.org).

    Signed-off-by: Evgeny Novikov <novikov@ispras.ru>
    Signed-off-by: Felipe Balbi <balbi@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/usb/gadget/udc/gr_udc.c | 7 +++++--
    1 file changed, 5 insertions(+), 2 deletions(-)

    diff --git a/drivers/usb/gadget/udc/gr_udc.c b/drivers/usb/gadget/udc/gr_udc.c
    index 116d386472efe..da73a06c20a39 100644
    --- a/drivers/usb/gadget/udc/gr_udc.c
    +++ b/drivers/usb/gadget/udc/gr_udc.c
    @@ -1980,9 +1980,12 @@ static int gr_ep_init(struct gr_udc *dev, int num, int is_in, u32 maxplimit)

    if (num == 0) {
    _req = gr_alloc_request(&ep->ep, GFP_ATOMIC);
    + if (!_req)
    + return -ENOMEM;
    +
    buf = devm_kzalloc(dev->dev, PAGE_SIZE, GFP_DMA | GFP_ATOMIC);
    - if (!_req || !buf) {
    - /* possible _req freed by gr_probe via gr_remove */
    + if (!buf) {
    + gr_free_request(&ep->ep, _req);
    return -ENOMEM;
    }

    --
    2.25.1


    \
     
     \ /
      Last update: 2020-07-27 16:35    [W:4.159 / U:0.036 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site