lkml.org 
[lkml]   [2021]   [Mar]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.4 36/75] USB: serial: io_edgeport: fix memory leak in edge_startup
    Date
    From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    From: Pavel Skripkin <paskripkin@gmail.com>

    commit cfdc67acc785e01a8719eeb7012709d245564701 upstream.

    sysbot found memory leak in edge_startup().
    The problem was that when an error was received from the usb_submit_urb(),
    nothing was cleaned up.

    Reported-by: syzbot+59f777bdcbdd7eea5305@syzkaller.appspotmail.com
    Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
    Fixes: 6e8cf7751f9f ("USB: add EPIC support to the io_edgeport driver")
    Cc: stable@vger.kernel.org # 2.6.21: c5c0c55598ce
    Signed-off-by: Johan Hovold <johan@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/usb/serial/io_edgeport.c | 26 ++++++++++++++++----------
    1 file changed, 16 insertions(+), 10 deletions(-)

    --- a/drivers/usb/serial/io_edgeport.c
    +++ b/drivers/usb/serial/io_edgeport.c
    @@ -2966,26 +2966,32 @@ static int edge_startup(struct usb_seria
    response = -ENODEV;
    }

    - usb_free_urb(edge_serial->interrupt_read_urb);
    - kfree(edge_serial->interrupt_in_buffer);
    -
    - usb_free_urb(edge_serial->read_urb);
    - kfree(edge_serial->bulk_in_buffer);
    -
    - kfree(edge_serial);
    -
    - return response;
    + goto error;
    }

    /* start interrupt read for this edgeport this interrupt will
    * continue as long as the edgeport is connected */
    response = usb_submit_urb(edge_serial->interrupt_read_urb,
    GFP_KERNEL);
    - if (response)
    + if (response) {
    dev_err(ddev, "%s - Error %d submitting control urb\n",
    __func__, response);
    +
    + goto error;
    + }
    }
    return response;
    +
    +error:
    + usb_free_urb(edge_serial->interrupt_read_urb);
    + kfree(edge_serial->interrupt_in_buffer);
    +
    + usb_free_urb(edge_serial->read_urb);
    + kfree(edge_serial->bulk_in_buffer);
    +
    + kfree(edge_serial);
    +
    + return response;
    }



    \
     
     \ /
      Last update: 2021-03-15 14:57    [W:4.502 / U:0.040 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site