| From 141bf0c12ab2c39b2b9747f760b660c864cdb4b2 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Fri, 26 Jun 2020 16:17:47 +0300 |
| Subject: usb: gadget: udc: gr_udc: fix memleak on error handling path in |
| gr_ep_init() |
| |
| From: Evgeny Novikov <novikov@ispras.ru> |
| |
| [ Upstream commit c8f8529e2c4141afa2ebb487ad48e8a6ec3e8c99 ] |
| |
| gr_ep_init() does not assign the allocated request anywhere if allocation |
| of memory for the buffer fails. This is a memory leak fixed by the given |
| patch. |
| |
| Found by Linux Driver Verification project (linuxtesting.org). |
| |
| Signed-off-by: Evgeny Novikov <novikov@ispras.ru> |
| Signed-off-by: Felipe Balbi <balbi@kernel.org> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/usb/gadget/udc/gr_udc.c | 7 +++++-- |
| 1 file changed, 5 insertions(+), 2 deletions(-) |
| |
| diff --git a/drivers/usb/gadget/udc/gr_udc.c b/drivers/usb/gadget/udc/gr_udc.c |
| index 594639e5cbf82..78168e1827b5e 100644 |
| --- a/drivers/usb/gadget/udc/gr_udc.c |
| +++ b/drivers/usb/gadget/udc/gr_udc.c |
| @@ -2001,9 +2001,12 @@ static int gr_ep_init(struct gr_udc *dev, int num, int is_in, u32 maxplimit) |
| |
| if (num == 0) { |
| _req = gr_alloc_request(&ep->ep, GFP_ATOMIC); |
| + if (!_req) |
| + return -ENOMEM; |
| + |
| buf = devm_kzalloc(dev->dev, PAGE_SIZE, GFP_DMA | GFP_ATOMIC); |
| - if (!_req || !buf) { |
| - /* possible _req freed by gr_probe via gr_remove */ |
| + if (!buf) { |
| + gr_free_request(&ep->ep, _req); |
| return -ENOMEM; |
| } |
| |
| -- |
| 2.25.1 |
| |