* [PATCH] drivers: usb: host: fix prevent memory leak in interrupt message submission
@ 2025-05-16 17:54 ant.v.moryakov
2025-05-16 18:31 ` Tom Rini
0 siblings, 1 reply; 8+ messages in thread
From: ant.v.moryakov @ 2025-05-16 17:54 UTC (permalink / raw)
To: u-boot; +Cc: trini, Anton Moryakov
From: Anton Moryakov <ant.v.moryakov@gmail.com>
Ensure int_queue is properly destroyed when receiving wrong buffer
by adding error handling path. Fixes memory leak that occurred
when backbuffer validation failed.
Signed-off-by: Anton Moryakov <ant.v.moryakov@gmail.com>
---
drivers/usb/host/ehci-hcd.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
index 7d5519c65a9..765d8b327ee 100644
--- a/drivers/usb/host/ehci-hcd.c
+++ b/drivers/usb/host/ehci-hcd.c
@@ -1557,6 +1557,7 @@ static int _ehci_submit_int_msg(struct usb_device *dev, unsigned long pipe,
debug("got wrong buffer back (%p instead of %p)\n",
backbuffer, buffer);
return -EINVAL;
+ goto err;
}
ret = _ehci_destroy_int_queue(dev, queue);
@@ -1565,6 +1566,10 @@ static int _ehci_submit_int_msg(struct usb_device *dev, unsigned long pipe,
/* everything worked out fine */
return result;
+
+err:
+ _ehci_destroy_int_queue(dev, queue);
+ return result;
}
static int _ehci_lock_async(struct ehci_ctrl *ctrl, int lock)
--
2.30.2
^ permalink raw reply related [flat|nested] 8+ messages in thread* Re: [PATCH] drivers: usb: host: fix prevent memory leak in interrupt message submission
2025-05-16 17:54 [PATCH] drivers: usb: host: fix prevent memory leak in interrupt message submission ant.v.moryakov
@ 2025-05-16 18:31 ` Tom Rini
2025-05-16 18:57 ` Anton Moryakov
0 siblings, 1 reply; 8+ messages in thread
From: Tom Rini @ 2025-05-16 18:31 UTC (permalink / raw)
To: ant.v.moryakov; +Cc: u-boot
[-- Attachment #1: Type: text/plain, Size: 979 bytes --]
On Fri, May 16, 2025 at 08:54:34PM +0300, ant.v.moryakov@gmail.com wrote:
> From: Anton Moryakov <ant.v.moryakov@gmail.com>
>
> Ensure int_queue is properly destroyed when receiving wrong buffer
> by adding error handling path. Fixes memory leak that occurred
> when backbuffer validation failed.
>
> Signed-off-by: Anton Moryakov <ant.v.moryakov@gmail.com>
> ---
> drivers/usb/host/ehci-hcd.c | 5 +++++
> 1 file changed, 5 insertions(+)
>
> diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
> index 7d5519c65a9..765d8b327ee 100644
> --- a/drivers/usb/host/ehci-hcd.c
> +++ b/drivers/usb/host/ehci-hcd.c
> @@ -1557,6 +1557,7 @@ static int _ehci_submit_int_msg(struct usb_device *dev, unsigned long pipe,
> debug("got wrong buffer back (%p instead of %p)\n",
> backbuffer, buffer);
> return -EINVAL;
> + goto err;
A goto after return cannot be right, and should have had some compiler
warnings too.
--
Tom
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 659 bytes --]
^ permalink raw reply [flat|nested] 8+ messages in thread* Re: [PATCH] drivers: usb: host: fix prevent memory leak in interrupt message submission
2025-05-16 18:31 ` Tom Rini
@ 2025-05-16 18:57 ` Anton Moryakov
2025-05-16 19:11 ` Tom Rini
0 siblings, 1 reply; 8+ messages in thread
From: Anton Moryakov @ 2025-05-16 18:57 UTC (permalink / raw)
To: Tom Rini; +Cc: u-boot
Thanks Tom — you're right, that `goto` after `return` is unreachable. I'll
fix that and resend with the corrected flow.
пт, 16 мая 2025 г. в 21:31, Tom Rini <trini@konsulko.com>:
> On Fri, May 16, 2025 at 08:54:34PM +0300, ant.v.moryakov@gmail.com wrote:
>
> > From: Anton Moryakov <ant.v.moryakov@gmail.com>
> >
> > Ensure int_queue is properly destroyed when receiving wrong buffer
> > by adding error handling path. Fixes memory leak that occurred
> > when backbuffer validation failed.
> >
> > Signed-off-by: Anton Moryakov <ant.v.moryakov@gmail.com>
> > ---
> > drivers/usb/host/ehci-hcd.c | 5 +++++
> > 1 file changed, 5 insertions(+)
> >
> > diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
> > index 7d5519c65a9..765d8b327ee 100644
> > --- a/drivers/usb/host/ehci-hcd.c
> > +++ b/drivers/usb/host/ehci-hcd.c
> > @@ -1557,6 +1557,7 @@ static int _ehci_submit_int_msg(struct usb_device
> *dev, unsigned long pipe,
> > debug("got wrong buffer back (%p instead of %p)\n",
> > backbuffer, buffer);
> > return -EINVAL;
> > + goto err;
>
> A goto after return cannot be right, and should have had some compiler
> warnings too.
>
> --
> Tom
>
^ permalink raw reply [flat|nested] 8+ messages in thread
* [PATCH] drivers: usb: host: fix prevent memory leak in interrupt message submission
@ 2025-05-16 19:36 ant.v.moryakov
2025-05-16 19:59 ` Fabio Estevam
0 siblings, 1 reply; 8+ messages in thread
From: ant.v.moryakov @ 2025-05-16 19:36 UTC (permalink / raw)
To: u-boot; +Cc: trini, Anton Moryakov
From: Anton Moryakov <ant.v.moryakov@gmail.com>
Ensure int_queue is properly destroyed when receiving wrong buffer
by adding error handling path. Fixes memory leak that occurred
when backbuffer validation failed.
Signed-off-by: Anton Moryakov <ant.v.moryakov@gmail.com>
---
drivers/usb/host/ehci-hcd.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
index 7d5519c65a9..765d8b327ee 100644
--- a/drivers/usb/host/ehci-hcd.c
+++ b/drivers/usb/host/ehci-hcd.c
@@ -1557,6 +1557,7 @@ static int _ehci_submit_int_msg(struct usb_device *dev, unsigned long pipe,
debug("got wrong buffer back (%p instead of %p)\n",
backbuffer, buffer);
result = -EINVAL;
+ goto err;
}
ret = _ehci_destroy_int_queue(dev, queue);
@@ -1565,6 +1566,10 @@ static int _ehci_submit_int_msg(struct usb_device *dev, unsigned long pipe,
/* everything worked out fine */
return result;
+
+err:
+ _ehci_destroy_int_queue(dev, queue); // Освобождаем очередь перед выходом
+ return result;
}
static int _ehci_lock_async(struct ehci_ctrl *ctrl, int lock)
--
2.30.2
^ permalink raw reply related [flat|nested] 8+ messages in thread* Re: [PATCH] drivers: usb: host: fix prevent memory leak in interrupt message submission
2025-05-16 19:36 ant.v.moryakov
@ 2025-05-16 19:59 ` Fabio Estevam
2025-05-16 20:04 ` Anton Moryakov
0 siblings, 1 reply; 8+ messages in thread
From: Fabio Estevam @ 2025-05-16 19:59 UTC (permalink / raw)
To: ant.v.moryakov; +Cc: u-boot, trini
On Fri, May 16, 2025 at 4:43 PM <ant.v.moryakov@gmail.com> wrote:
> @@ -1557,6 +1557,7 @@ static int _ehci_submit_int_msg(struct usb_device *dev, unsigned long pipe,
> debug("got wrong buffer back (%p instead of %p)\n",
> backbuffer, buffer);
> result = -EINVAL;
> + goto err;
Was this supposed to be a v2? The error Tim pointed out is still here.
ret = _ehci_destroy_int_queue(dev, queue);
> @@ -1565,6 +1566,10 @@ static int _ehci_submit_int_msg(struct usb_device *dev, unsigned long pipe,
>
> /* everything worked out fine */
> return result;
> +
> +err:
> + _ehci_destroy_int_queue(dev, queue); // Освобождаем очередь перед выходом
Please remove the comment.
^ permalink raw reply [flat|nested] 8+ messages in thread* Re: [PATCH] drivers: usb: host: fix prevent memory leak in interrupt message submission
2025-05-16 19:59 ` Fabio Estevam
@ 2025-05-16 20:04 ` Anton Moryakov
0 siblings, 0 replies; 8+ messages in thread
From: Anton Moryakov @ 2025-05-16 20:04 UTC (permalink / raw)
To: Fabio Estevam; +Cc: u-boot, trini
Hi Fabio,
Thanks for the review. Yes, this is v2 — the issue Tom pointed out
(unreachable `goto` after `return`) was fixed by replacing it with `result
= -EINVAL; goto err;`.
In v3 I’ve now removed the leftover comment. No other functional changes.
Best regards,
Anton
пт, 16 мая 2025 г. в 22:59, Fabio Estevam <festevam@gmail.com>:
> On Fri, May 16, 2025 at 4:43 PM <ant.v.moryakov@gmail.com> wrote:
>
> > @@ -1557,6 +1557,7 @@ static int _ehci_submit_int_msg(struct usb_device
> *dev, unsigned long pipe,
> > debug("got wrong buffer back (%p instead of %p)\n",
> > backbuffer, buffer);
> > result = -EINVAL;
> > + goto err;
>
> Was this supposed to be a v2? The error Tim pointed out is still here.
>
> ret = _ehci_destroy_int_queue(dev, queue);
> > @@ -1565,6 +1566,10 @@ static int _ehci_submit_int_msg(struct usb_device
> *dev, unsigned long pipe,
> >
> > /* everything worked out fine */
> > return result;
> > +
> > +err:
> > + _ehci_destroy_int_queue(dev, queue); // Освобождаем очередь перед
> выходом
>
> Please remove the comment.
>
^ permalink raw reply [flat|nested] 8+ messages in thread
* [PATCH] drivers: usb: host: fix prevent memory leak in interrupt message submission
@ 2025-05-16 17:50 ant.v.moryakov
0 siblings, 0 replies; 8+ messages in thread
From: ant.v.moryakov @ 2025-05-16 17:50 UTC (permalink / raw)
To: u-boot; +Cc: trini, Anton Moryakov
From: Anton Moryakov <ant.v.moryakov@gmail.com>
Ensure int_queue is properly destroyed when receiving wrong buffer
by adding error handling path. Fixes memory leak that occurred
when backbuffer validation failed.
Signed-off-by: Anton Moryakov <ant.v.moryakov@gmail.com>
---
drivers/usb/host/ehci-hcd.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
index 7d5519c65a9..765d8b327ee 100644
--- a/drivers/usb/host/ehci-hcd.c
+++ b/drivers/usb/host/ehci-hcd.c
@@ -1557,6 +1557,7 @@ static int _ehci_submit_int_msg(struct usb_device *dev, unsigned long pipe,
debug("got wrong buffer back (%p instead of %p)\n",
backbuffer, buffer);
return -EINVAL;
+ goto err;
}
ret = _ehci_destroy_int_queue(dev, queue);
@@ -1565,6 +1566,10 @@ static int _ehci_submit_int_msg(struct usb_device *dev, unsigned long pipe,
/* everything worked out fine */
return result;
+
+err:
+ _ehci_destroy_int_queue(dev, queue); // Освобождаем очередь перед выходом
+ return result;
}
static int _ehci_lock_async(struct ehci_ctrl *ctrl, int lock)
--
2.30.2
^ permalink raw reply related [flat|nested] 8+ messages in thread
end of thread, other threads:[~2025-05-16 20:05 UTC | newest]
Thread overview: 8+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-05-16 17:54 [PATCH] drivers: usb: host: fix prevent memory leak in interrupt message submission ant.v.moryakov
2025-05-16 18:31 ` Tom Rini
2025-05-16 18:57 ` Anton Moryakov
2025-05-16 19:11 ` Tom Rini
-- strict thread matches above, loose matches on Subject: below --
2025-05-16 19:36 ant.v.moryakov
2025-05-16 19:59 ` Fabio Estevam
2025-05-16 20:04 ` Anton Moryakov
2025-05-16 17:50 ant.v.moryakov
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.