From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932704AbcFOHlg (ORCPT ); Wed, 15 Jun 2016 03:41:36 -0400 Received: from mx2.suse.de ([195.135.220.15]:34283 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932345AbcFOHba (ORCPT ); Wed, 15 Jun 2016 03:31:30 -0400 X-Amavis-Alert: BAD HEADER SECTION, Duplicate header field: "References" From: Jiri Slaby To: stable@vger.kernel.org Cc: linux-kernel@vger.kernel.org, Johan Hovold , Jiri Slaby Subject: [PATCH 3.12 25/56] USB: serial: io_edgeport: fix memory leaks in attach error path Date: Wed, 15 Jun 2016 09:30:49 +0200 Message-Id: X-Mailer: git-send-email 2.9.0 In-Reply-To: <352d108e14e126b7dfb5fbecde3dc78be62a5ce5.1465975780.git.jslaby@suse.cz> References: <352d108e14e126b7dfb5fbecde3dc78be62a5ce5.1465975780.git.jslaby@suse.cz> In-Reply-To: References: Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Johan Hovold 3.12-stable review patch. If anyone has any objections, please let me know. =============== commit c5c0c55598cefc826d6cfb0a417eeaee3631715c upstream. Private data, URBs and buffers allocated for Epic devices during attach were never released on errors (e.g. missing endpoints). Fixes: 6e8cf7751f9f ("USB: add EPIC support to the io_edgeport driver") Signed-off-by: Johan Hovold Acked-by: Greg Kroah-Hartman Signed-off-by: Jiri Slaby --- drivers/usb/serial/io_edgeport.c | 33 ++++++++++++++++++++++++--------- 1 file changed, 24 insertions(+), 9 deletions(-) diff --git a/drivers/usb/serial/io_edgeport.c b/drivers/usb/serial/io_edgeport.c index c91481d74a14..60bff3b75609 100644 --- a/drivers/usb/serial/io_edgeport.c +++ b/drivers/usb/serial/io_edgeport.c @@ -2879,14 +2879,15 @@ static int edge_startup(struct usb_serial *serial) usb_alloc_urb(0, GFP_KERNEL); if (!edge_serial->interrupt_read_urb) { dev_err(ddev, "out of memory\n"); - return -ENOMEM; + response = -ENOMEM; + break; } edge_serial->interrupt_in_buffer = kmalloc(buffer_size, GFP_KERNEL); if (!edge_serial->interrupt_in_buffer) { dev_err(ddev, "out of memory\n"); - usb_free_urb(edge_serial->interrupt_read_urb); - return -ENOMEM; + response = -ENOMEM; + break; } edge_serial->interrupt_in_endpoint = endpoint->bEndpointAddress; @@ -2916,14 +2917,15 @@ static int edge_startup(struct usb_serial *serial) usb_alloc_urb(0, GFP_KERNEL); if (!edge_serial->read_urb) { dev_err(ddev, "out of memory\n"); - return -ENOMEM; + response = -ENOMEM; + break; } edge_serial->bulk_in_buffer = kmalloc(buffer_size, GFP_KERNEL); if (!edge_serial->bulk_in_buffer) { dev_err(&dev->dev, "out of memory\n"); - usb_free_urb(edge_serial->read_urb); - return -ENOMEM; + response = -ENOMEM; + break; } edge_serial->bulk_in_endpoint = endpoint->bEndpointAddress; @@ -2949,9 +2951,22 @@ static int edge_startup(struct usb_serial *serial) } } - if (!interrupt_in_found || !bulk_in_found || !bulk_out_found) { - dev_err(ddev, "Error - the proper endpoints were not found!\n"); - return -ENODEV; + if (response || !interrupt_in_found || !bulk_in_found || + !bulk_out_found) { + if (!response) { + dev_err(ddev, "expected endpoints not found\n"); + response = -ENODEV; + } + + usb_free_urb(edge_serial->interrupt_read_urb); + kfree(edge_serial->interrupt_in_buffer); + + usb_free_urb(edge_serial->read_urb); + kfree(edge_serial->bulk_in_buffer); + + kfree(edge_serial); + + return response; } /* start interrupt read for this edgeport this interrupt will -- 2.9.0