evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

[PATCH] USB ATM: avoid oops on bind failure; plug memory leak

Browse source 
Zero the entire instance, not just the struct usbatm_data head.
Make sure the just allocated urb is freed if we fail to allocate
a buffer.  Based on a patch by Stanislaw W. Gruszka.

Signed-off-by: Duncan Sands <baldrick@free.fr>
Acked-by: Pete Zaitcev <zaitcev@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This commit is contained in:
Duncan Sands 2005-05-27 10:00:08 +02:00 • committed by Greg Kroah-Hartman
parent e20d6645f7
commit 65412e48e2
1 changed files with 5 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
drivers/usb/atm/usbatm.c
View file

@ -949,6 +949,7 @@ int usbatm_usb_probe(struct usb_interface *intf, const struct usb_device_id *id,
struct usb_device *usb_dev = interface_to_usbdev(intf); struct usb_device *usb_dev = interface_to_usbdev(intf);
struct usbatm_data *instance; struct usbatm_data *instance;
char *buf; char *buf;
size_t instance_size = sizeof(*instance) + sizeof(struct urb *) * (num_rcv_urbs + num_snd_urbs);
int error = -ENOMEM; int error = -ENOMEM;
int i, length; int i, length;
int need_heavy; int need_heavy;
@ -960,14 +961,13 @@ int usbatm_usb_probe(struct usb_interface *intf, const struct usb_device_id *id,
intf->altsetting->desc.bInterfaceNumber); intf->altsetting->desc.bInterfaceNumber);
/* instance init */ /* instance init */
instance = kmalloc(sizeof(*instance) + sizeof(struct urb *) * (num_rcv_urbs + num_snd_urbs), instance = kmalloc(instance_size, GFP_KERNEL);
GFP_KERNEL);
if (!instance) { if (!instance) {
dev_dbg(dev, "%s: no memory for instance data!\n", __func__); dev_dbg(dev, "%s: no memory for instance data!\n", __func__);
return -ENOMEM; return -ENOMEM;
} }
memset(instance, 0, sizeof(*instance)); memset(instance, 0, instance_size);
/* public fields */ /* public fields */
@ -1051,6 +1051,8 @@ int usbatm_usb_probe(struct usb_interface *intf, const struct usb_device_id *id,
goto fail_unbind; goto fail_unbind;
} }
instance->urbs[i] = urb;
buffer = kmalloc(channel->buf_size, GFP_KERNEL); buffer = kmalloc(channel->buf_size, GFP_KERNEL);
if (!buffer) { if (!buffer) {
dev_dbg(dev, "%s: no memory for buffer %d!\n", __func__, i); dev_dbg(dev, "%s: no memory for buffer %d!\n", __func__, i);
@ -1078,7 +1080,6 @@ int usbatm_usb_probe(struct usb_interface *intf, const struct usb_device_id *id,
vdbg("%s: alloced buffer 0x%p buf size %u urb 0x%p", vdbg("%s: alloced buffer 0x%p buf size %u urb 0x%p",
__func__, urb->transfer_buffer, urb->transfer_buffer_length, urb); __func__, urb->transfer_buffer, urb->transfer_buffer_length, urb);
instance->urbs[i] = urb;
} }
if (need_heavy && driver->heavy_init) { if (need_heavy && driver->heavy_init) {