renegade-project/linux-next
2
0
Fork 0
mirror of https://github.com/edk2-porting/linux-next.git synced 2024-12-19 02:34:01 +08:00
Code

USB: serial: io_edgeport: fix memory leak in edge_startup

Browse Source 
sysbot found memory leak in edge_startup().
The problem was that when an error was received from the usb_submit_urb(),
nothing was cleaned up.

Reported-by: syzbot+59f777bdcbdd7eea5305@syzkaller.appspotmail.com
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Fixes: 6e8cf7751f ("USB: add EPIC support to the io_edgeport driver")
Cc: stable@vger.kernel.org	# 2.6.21: c5c0c55598
Signed-off-by: Johan Hovold <johan@kernel.org>
This commit is contained in:
Pavel Skripkin 2021-03-02 02:01:52 +03:00 committed by Johan Hovold
parent 5563b3b642
commit cfdc67acc7
1 changed files with 16 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
drivers/usb/serial/io_edgeport.c
View File

@ -3003,26 +3003,32 @@ static int edge_startup(struct usb_serial *serial)
response = -ENODEV; response = -ENODEV;
} }
usb_free_urb(edge_serial->interrupt_read_urb); goto error;
kfree(edge_serial->interrupt_in_buffer);
usb_free_urb(edge_serial->read_urb);
kfree(edge_serial->bulk_in_buffer);
kfree(edge_serial);
return response;
} }
/* start interrupt read for this edgeport this interrupt will /* start interrupt read for this edgeport this interrupt will
* continue as long as the edgeport is connected */ * continue as long as the edgeport is connected */
response = usb_submit_urb(edge_serial->interrupt_read_urb, response = usb_submit_urb(edge_serial->interrupt_read_urb,
GFP_KERNEL); GFP_KERNEL);
if (response) if (response) {
dev_err(ddev, "%s - Error %d submitting control urb\n", dev_err(ddev, "%s - Error %d submitting control urb\n",
__func__, response); __func__, response);
goto error;
}
} }
return response; return response;
error:
usb_free_urb(edge_serial->interrupt_read_urb);
kfree(edge_serial->interrupt_in_buffer);
usb_free_urb(edge_serial->read_urb);
kfree(edge_serial->bulk_in_buffer);
kfree(edge_serial);
return response;
} }