Re: [PATCH 4.19 22/90] usb: gadget: fusb300_udc: Fix memory leak of fusb300->ep[i]

Pavel Machek
2019-07-09T08:13:09Z

[-- Attachment #1: Type: text/plain, Size: 1528 bytes --]

Hi!

> There is no deallocation of fusb300->ep[i] elements, allocated at
> fusb300_probe.
>
> The patch adds deallocation of fusb300->ep array elements.
...
> diff --git a/drivers/usb/gadget/udc/fusb300_udc.c b/drivers/usb/gadget/udc/fusb300_udc.c
> index 263804d154a7..00e3f66836a9 100644
> --- a/drivers/usb/gadget/udc/fusb300_udc.c
> +++ b/drivers/usb/gadget/udc/fusb300_udc.c
> @@ -1342,12 +1342,15 @@ static const struct usb_gadget_ops fusb300_gadget_ops = {
> static int fusb300_remove(struct platform_device *pdev)
> {
> struct fusb300 *fusb300 = platform_get_drvdata(pdev);
> + int i;
>
> usb_del_gadget_udc(&fusb300->gadget);
> iounmap(fusb300->reg);
> free_irq(platform_get_irq(pdev, 0), fusb300);
>
> fusb300_free_request(&fusb300->ep[0]->ep, fusb300->ep0_req);
> + for (i = 0; i < FUSB300_MAX_NUM_EP; i++)
> + kfree(fusb300->ep[i]);
> kfree(fusb300);
>
> return 0;
> @@ -1491,6 +1494,8 @@ clean_up:
> if (fusb300->ep0_req)
> fusb300_free_request(&fusb300->ep[0]->ep,
> fusb300->ep0_req);
> + for (i = 0; i < FUSB300_MAX_NUM_EP; i++)
> + kfree(fusb300->ep[i]);
> kfree(fusb300);
> }
> if (reg)

Maybe it would be worth it to have a common function doing the cleanup
at this point?

Alternatively consider using devm_ function family; that deallocates
memory automatically.
Pavel
--
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 181 bytes --]