From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751755AbdG0CZy (ORCPT ); Wed, 26 Jul 2017 22:25:54 -0400 Received: from mga14.intel.com ([192.55.52.115]:60280 "EHLO mga14.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751558AbdG0CYt (ORCPT ); Wed, 26 Jul 2017 22:24:49 -0400 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.40,417,1496127600"; d="scan'208";a="112421977" From: Lu Baolu To: Mathias Nyman Cc: linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org, zhengjun.xing@linux.intel.com, Lu Baolu Subject: [PATCH v2 3/5] usb: xhci: Fix memory leak when xhci_disable_slot() returns error Date: Thu, 27 Jul 2017 10:21:36 +0800 Message-Id: <1501122098-10935-4-git-send-email-baolu.lu@linux.intel.com> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1501122098-10935-1-git-send-email-baolu.lu@linux.intel.com> References: <1501122098-10935-1-git-send-email-baolu.lu@linux.intel.com> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org If xhci_disable_slot() returns success, a disable slot command trb was queued in the command ring. The command completion handler will free the virtual device data structure associated with the slot. On the other hand, when xhci_disable_slot() returns error, the invokers should take the responsibilities to free the slot related data structure. Otherwise, memory leakage happens. Signed-off-by: Lu Baolu --- drivers/usb/host/xhci.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c index cb2461a..2df601e 100644 --- a/drivers/usb/host/xhci.c +++ b/drivers/usb/host/xhci.c @@ -3547,11 +3547,9 @@ static void xhci_free_dev(struct usb_hcd *hcd, struct usb_device *udev) del_timer_sync(&virt_dev->eps[i].stop_cmd_timer); } - xhci_disable_slot(xhci, udev->slot_id); - /* - * Event command completion handler will free any data structures - * associated with the slot. XXX Can free sleep? - */ + ret = xhci_disable_slot(xhci, udev->slot_id); + if (ret) + xhci_free_virt_device(xhci, udev->slot_id); } int xhci_disable_slot(struct xhci_hcd *xhci, u32 slot_id) @@ -3697,7 +3695,11 @@ int xhci_alloc_dev(struct usb_hcd *hcd, struct usb_device *udev) return 1; disable_slot: - return xhci_disable_slot(xhci, udev->slot_id); + ret = xhci_disable_slot(xhci, udev->slot_id); + if (ret) + xhci_free_virt_device(xhci, udev->slot_id); + + return 0; } /* -- 2.7.4