evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

usb: gadget: fotg210-udc: Fix memory leak of fotg210->ep[i]

Browse source 
[ Upstream commit c37bd52836296ecc9a0fc8060b819089aebdbcde ]

There is no deallocation of fotg210->ep[i] elements, allocated at
fotg210_udc_probe.

The patch adds deallocation of fotg210->ep array elements and simplifies
error path of fotg210_udc_probe().

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Anton Vasilyev <vasilyev@ispras.ru>
Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Anton Vasilyev 2018-08-07 14:44:48 +03:00 • committed by Greg Kroah-Hartman
parent 82660490d5
commit 093da71c6e
1 changed files with 10 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
drivers/usb/gadget/udc/fotg210-udc.c
View file

@ -1066,12 +1066,15 @@ static struct usb_gadget_ops fotg210_gadget_ops = {
static int fotg210_udc_remove(struct platform_device *pdev) static int fotg210_udc_remove(struct platform_device *pdev)
{ {
struct fotg210_udc *fotg210 = platform_get_drvdata(pdev); struct fotg210_udc *fotg210 = platform_get_drvdata(pdev);
int i;
usb_del_gadget_udc(&fotg210->gadget); usb_del_gadget_udc(&fotg210->gadget);
iounmap(fotg210->reg); iounmap(fotg210->reg);
free_irq(platform_get_irq(pdev, 0), fotg210); free_irq(platform_get_irq(pdev, 0), fotg210);
fotg210_ep_free_request(&fotg210->ep[0]->ep, fotg210->ep0_req); fotg210_ep_free_request(&fotg210->ep[0]->ep, fotg210->ep0_req);
for (i = 0; i < FOTG210_MAX_NUM_EP; i++)
kfree(fotg210->ep[i]);
kfree(fotg210); kfree(fotg210);
return 0; return 0;
@ -1102,7 +1105,7 @@ static int fotg210_udc_probe(struct platform_device *pdev)
/* initialize udc */ /* initialize udc */
fotg210 = kzalloc(sizeof(struct fotg210_udc), GFP_KERNEL); fotg210 = kzalloc(sizeof(struct fotg210_udc), GFP_KERNEL);
if (fotg210 == NULL) if (fotg210 == NULL)
goto err_alloc; goto err;
for (i = 0; i < FOTG210_MAX_NUM_EP; i++) { for (i = 0; i < FOTG210_MAX_NUM_EP; i++) {
_ep[i] = kzalloc(sizeof(struct fotg210_ep), GFP_KERNEL); _ep[i] = kzalloc(sizeof(struct fotg210_ep), GFP_KERNEL);
@ -1114,7 +1117,7 @@ static int fotg210_udc_probe(struct platform_device *pdev)
fotg210->reg = ioremap(res->start, resource_size(res)); fotg210->reg = ioremap(res->start, resource_size(res));
if (fotg210->reg == NULL) { if (fotg210->reg == NULL) {
pr_err("ioremap error.\n"); pr_err("ioremap error.\n");
goto err_map; goto err_alloc;
} }
spin_lock_init(&fotg210->lock); spin_lock_init(&fotg210->lock);
@ -1162,7 +1165,7 @@ static int fotg210_udc_probe(struct platform_device *pdev)
fotg210->ep0_req = fotg210_ep_alloc_request(&fotg210->ep[0]->ep, fotg210->ep0_req = fotg210_ep_alloc_request(&fotg210->ep[0]->ep,
GFP_KERNEL); GFP_KERNEL);
if (fotg210->ep0_req == NULL) if (fotg210->ep0_req == NULL)
goto err_req; goto err_map;
fotg210_init(fotg210); fotg210_init(fotg210);
@ -1190,12 +1193,14 @@ err_req:
fotg210_ep_free_request(&fotg210->ep[0]->ep, fotg210->ep0_req); fotg210_ep_free_request(&fotg210->ep[0]->ep, fotg210->ep0_req);
err_map: err_map:
if (fotg210->reg) iounmap(fotg210->reg);
iounmap(fotg210->reg);
err_alloc: err_alloc:
for (i = 0; i < FOTG210_MAX_NUM_EP; i++)
kfree(fotg210->ep[i]);
kfree(fotg210); kfree(fotg210);
err:
return ret; return ret;
} }