| From d794a02111cd3393da69bc7d6dd2b6074bd037cc Mon Sep 17 00:00:00 2001 |
| From: Oliver Neukum <oliver@neukum.org> |
| Date: Sun, 28 Jun 2009 23:34:14 +0200 |
| Subject: USB: fix memleak in usbfs |
| |
| From: Oliver Neukum <oliver@neukum.org> |
| |
| commit d794a02111cd3393da69bc7d6dd2b6074bd037cc upstream. |
| |
| This patch fixes a memory leak in devio.c::processcompl |
| |
| If writing to user space fails the packet must be discarded, as it |
| already has been removed from the queue of completed packets. |
| |
| Signed-off-by: Oliver Neukum <oliver@neukum.org> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> |
| |
| --- |
| drivers/usb/core/devio.c | 16 ++++++++++------ |
| 1 file changed, 10 insertions(+), 6 deletions(-) |
| |
| --- a/drivers/usb/core/devio.c |
| +++ b/drivers/usb/core/devio.c |
| @@ -1230,22 +1230,22 @@ static int processcompl(struct async *as |
| if (as->userbuffer) |
| if (copy_to_user(as->userbuffer, urb->transfer_buffer, |
| urb->transfer_buffer_length)) |
| - return -EFAULT; |
| + goto err_out; |
| if (put_user(as->status, &userurb->status)) |
| - return -EFAULT; |
| + goto err_out; |
| if (put_user(urb->actual_length, &userurb->actual_length)) |
| - return -EFAULT; |
| + goto err_out; |
| if (put_user(urb->error_count, &userurb->error_count)) |
| - return -EFAULT; |
| + goto err_out; |
| |
| if (usb_endpoint_xfer_isoc(&urb->ep->desc)) { |
| for (i = 0; i < urb->number_of_packets; i++) { |
| if (put_user(urb->iso_frame_desc[i].actual_length, |
| &userurb->iso_frame_desc[i].actual_length)) |
| - return -EFAULT; |
| + goto err_out; |
| if (put_user(urb->iso_frame_desc[i].status, |
| &userurb->iso_frame_desc[i].status)) |
| - return -EFAULT; |
| + goto err_out; |
| } |
| } |
| |
| @@ -1254,6 +1254,10 @@ static int processcompl(struct async *as |
| if (put_user(addr, (void __user * __user *)arg)) |
| return -EFAULT; |
| return 0; |
| + |
| +err_out: |
| + free_async(as); |
| + return -EFAULT; |
| } |
| |
| static struct async *reap_as(struct dev_state *ps) |