linux-usb.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [stable,3.18-4.9] xhci: Fix ring leak in failure path of xhci_alloc_virt_device()
@ 2018-01-11 17:01 Ben Hutchings
  0 siblings, 0 replies; 2+ messages in thread
From: Ben Hutchings @ 2018-01-11 17:01 UTC (permalink / raw)
  To: stable; +Cc: Mathias Nyman, linux-usb

This is a stable-only fix for the backport of commit 5d9b70f7d52e
("xhci: Don't add a virt_dev to the devs array before it's fully
allocated").

In branches that predate commit c5628a2af83a ("xhci: remove endpoint
ring cache") there is an additional failure path in
xhci_alloc_virt_device() where ring cache allocation fails, in
which case we need to free the ring allocated for endpoint 0.

Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
---
This is build-tested only.

Ben.

 drivers/usb/host/xhci-mem.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
index f7481c4e2bc9..d9363713b7f1 100644
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -1071,7 +1071,8 @@ int xhci_alloc_virt_device(struct xhci_hcd *xhci, int slot_id,
 
 	return 1;
 fail:
-
+	if (dev->eps[0].ring)
+		xhci_ring_free(xhci, dev->eps[0].ring);
 	if (dev->in_ctx)
 		xhci_free_container_ctx(xhci, dev->in_ctx);
 	if (dev->out_ctx)

^ permalink raw reply related	[flat|nested] 2+ messages in thread

* [stable,3.18-4.9] xhci: Fix ring leak in failure path of xhci_alloc_virt_device()
@ 2018-01-11 17:13 Greg KH
  0 siblings, 0 replies; 2+ messages in thread
From: Greg KH @ 2018-01-11 17:13 UTC (permalink / raw)
  To: Ben Hutchings; +Cc: stable, Mathias Nyman, linux-usb

On Thu, Jan 11, 2018 at 05:01:36PM +0000, Ben Hutchings wrote:
> This is a stable-only fix for the backport of commit 5d9b70f7d52e
> ("xhci: Don't add a virt_dev to the devs array before it's fully
> allocated").
> 
> In branches that predate commit c5628a2af83a ("xhci: remove endpoint
> ring cache") there is an additional failure path in
> xhci_alloc_virt_device() where ring cache allocation fails, in
> which case we need to free the ring allocated for endpoint 0.
> 
> Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
> ---
> This is build-tested only.

Looks good to me, thanks for this!

Mathias, yell if you think it's wrong :)

greg k-h
---
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

^ permalink raw reply	[flat|nested] 2+ messages in thread

end of thread, other threads:[~2018-01-11 17:13 UTC | newest]

Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2018-01-11 17:13 [stable,3.18-4.9] xhci: Fix ring leak in failure path of xhci_alloc_virt_device() Greg KH
  -- strict thread matches above, loose matches on Subject: below --
2018-01-11 17:01 Ben Hutchings

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).