[PATCH v2] cdc-acm: fix resource reclaim in error path of acm_probe

[PATCH v2] cdc-acm: fix resource reclaim in error path of acm_probe

[Axel Lin]

This patch fixes resource reclaim in error path of acm_probe:
1. In the case of "out of memory (read urbs usb_alloc_urb)\n")",
there is no need to call acm_read_buffers_free(acm) here.
Fix it by goto alloc_fail6 instead of alloc_fail7.
2. In the case of "out of memory (write urbs usb_alloc_urb)",
usb_alloc_urb may fail in any iteration of the for loop.
Current implementation does not properly free allocated snd->urb.
Fix it by goto alloc_fail8 instead of alloc_fail7.
3. In the case of device_create_file(&intf->dev,&dev_attr_iCountryCodeRelDate)
fail, acm->country_codes is kfreed. As a result, device_remove_file for
dev_attr_wCountryCodes will not be executed in acm_disconnect.
Fix it by calling device_remove_file for dev_attr_wCountryCodes before goto
skip_countries.

Signed-off-by: Axel Lin <axel.lin@gmail.com>
---
 drivers/usb/class/cdc-acm.c |    6 ++++--
 1 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 0c2f14f..61d7550 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1201,7 +1201,7 @@ made_compressed_probe:
 		if (rcv->urb == NULL) {
 			dev_dbg(&intf->dev,
 				"out of memory (read urbs usb_alloc_urb)\n");
-			goto alloc_fail7;
+			goto alloc_fail6;
 		}
 
 		rcv->urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
@@ -1225,7 +1225,7 @@ made_compressed_probe:
 		if (snd->urb == NULL) {
 			dev_dbg(&intf->dev,
 				"out of memory (write urbs usb_alloc_urb)");
-			goto alloc_fail7;
+			goto alloc_fail8;
 		}
 
 		if (usb_endpoint_xfer_int(epwrite))
@@ -1264,6 +1264,7 @@ made_compressed_probe:
 		i = device_create_file(&intf->dev,
 						&dev_attr_iCountryCodeRelDate);
 		if (i < 0) {
+			device_remove_file(&intf->dev, &dev_attr_wCountryCodes);
 			kfree(acm->country_codes);
 			goto skip_countries;
 		}
@@ -1300,6 +1301,7 @@ alloc_fail8:
 		usb_free_urb(acm->wb[i].urb);
 alloc_fail7:
 	acm_read_buffers_free(acm);
+alloc_fail6:
 	for (i = 0; i < num_rx_buf; i++)
 		usb_free_urb(acm->ru[i].urb);
 	usb_free_urb(acm->ctrlurb);
-- 
1.5.4.3

Re: [PATCH v2] cdc-acm: fix resource reclaim in error path of acm_probe

[Oliver Neukum]

Am Montag, 31. Mai 2010 02:04:47 schrieb Axel Lin:
> This patch fixes resource reclaim in error path of acm_probe:
> 1. In the case of "out of memory (read urbs usb_alloc_urb)\n")",
> there is no need to call acm_read_buffers_free(acm) here.
> Fix it by goto alloc_fail6 instead of alloc_fail7.
> 2. In the case of "out of memory (write urbs usb_alloc_urb)",
> usb_alloc_urb may fail in any iteration of the for loop.
> Current implementation does not properly free allocated snd->urb.
> Fix it by goto alloc_fail8 instead of alloc_fail7.
> 3. In the case of device_create_file(&intf->dev,&dev_attr_iCountryCodeRelDate)
> fail, acm->country_codes is kfreed. As a result, device_remove_file for
> dev_attr_wCountryCodes will not be executed in acm_disconnect.
> Fix it by calling device_remove_file for dev_attr_wCountryCodes before goto
> skip_countries.
> 
> Signed-off-by: Axel Lin <axel.lin@gmail.com>
Acked-by: Oliver Neukum <oneukum@suse.de>