| From a5083de0b1d0af3e82e03599335a366847ca19c4 Mon Sep 17 00:00:00 2001 |
| From: Evgeny Novikov <novikov@ispras.ru> |
| Date: Fri, 26 Jun 2020 16:17:47 +0300 |
| Subject: [PATCH] usb: gadget: udc: gr_udc: fix memleak on error handling path |
| in gr_ep_init() |
| |
| commit c8f8529e2c4141afa2ebb487ad48e8a6ec3e8c99 upstream. |
| |
| gr_ep_init() does not assign the allocated request anywhere if allocation |
| of memory for the buffer fails. This is a memory leak fixed by the given |
| patch. |
| |
| Found by Linux Driver Verification project (linuxtesting.org). |
| |
| Signed-off-by: Evgeny Novikov <novikov@ispras.ru> |
| Signed-off-by: Felipe Balbi <balbi@kernel.org> |
| Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> |
| |
| diff --git a/drivers/usb/gadget/udc/gr_udc.c b/drivers/usb/gadget/udc/gr_udc.c |
| index e50108f9a374..e0b2fb33ed0d 100644 |
| --- a/drivers/usb/gadget/udc/gr_udc.c |
| +++ b/drivers/usb/gadget/udc/gr_udc.c |
| @@ -1980,9 +1980,12 @@ static int gr_ep_init(struct gr_udc *dev, int num, int is_in, u32 maxplimit) |
| |
| if (num == 0) { |
| _req = gr_alloc_request(&ep->ep, GFP_ATOMIC); |
| + if (!_req) |
| + return -ENOMEM; |
| + |
| buf = devm_kzalloc(dev->dev, PAGE_SIZE, GFP_DMA | GFP_ATOMIC); |
| - if (!_req || !buf) { |
| - /* possible _req freed by gr_probe via gr_remove */ |
| + if (!buf) { |
| + gr_free_request(&ep->ep, _req); |
| return -ENOMEM; |
| } |
| |
| -- |
| 2.27.0 |
| |
