From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-eopbgr700117.outbound.protection.outlook.com ([40.107.70.117]:52496 "EHLO NAM04-SN1-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1726992AbeJAHNR (ORCPT ); Mon, 1 Oct 2018 03:13:17 -0400 From: Sasha Levin To: "stable@vger.kernel.org" , "linux-kernel@vger.kernel.org" CC: Anton Vasilyev , Felipe Balbi , Sasha Levin Subject: [PATCH AUTOSEL 4.18 05/65] usb: gadget: fotg210-udc: Fix memory leak of fotg210->ep[i] Date: Mon, 1 Oct 2018 00:38:04 +0000 Message-ID: <20181001003754.146961-5-alexander.levin@microsoft.com> References: <20181001003754.146961-1-alexander.levin@microsoft.com> In-Reply-To: <20181001003754.146961-1-alexander.levin@microsoft.com> Content-Language: en-US Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org List-ID: From: Anton Vasilyev [ Upstream commit c37bd52836296ecc9a0fc8060b819089aebdbcde ] There is no deallocation of fotg210->ep[i] elements, allocated at fotg210_udc_probe. The patch adds deallocation of fotg210->ep array elements and simplifies error path of fotg210_udc_probe(). Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Anton Vasilyev Signed-off-by: Felipe Balbi Signed-off-by: Sasha Levin --- drivers/usb/gadget/udc/fotg210-udc.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/drivers/usb/gadget/udc/fotg210-udc.c b/drivers/usb/gadget/udc/= fotg210-udc.c index 53a48f561458..587c5037ff07 100644 --- a/drivers/usb/gadget/udc/fotg210-udc.c +++ b/drivers/usb/gadget/udc/fotg210-udc.c @@ -1063,12 +1063,15 @@ static const struct usb_gadget_ops fotg210_gadget_o= ps =3D { static int fotg210_udc_remove(struct platform_device *pdev) { struct fotg210_udc *fotg210 =3D platform_get_drvdata(pdev); + int i; =20 usb_del_gadget_udc(&fotg210->gadget); iounmap(fotg210->reg); free_irq(platform_get_irq(pdev, 0), fotg210); =20 fotg210_ep_free_request(&fotg210->ep[0]->ep, fotg210->ep0_req); + for (i =3D 0; i < FOTG210_MAX_NUM_EP; i++) + kfree(fotg210->ep[i]); kfree(fotg210); =20 return 0; @@ -1099,7 +1102,7 @@ static int fotg210_udc_probe(struct platform_device *= pdev) /* initialize udc */ fotg210 =3D kzalloc(sizeof(struct fotg210_udc), GFP_KERNEL); if (fotg210 =3D=3D NULL) - goto err_alloc; + goto err; =20 for (i =3D 0; i < FOTG210_MAX_NUM_EP; i++) { _ep[i] =3D kzalloc(sizeof(struct fotg210_ep), GFP_KERNEL); @@ -1111,7 +1114,7 @@ static int fotg210_udc_probe(struct platform_device *= pdev) fotg210->reg =3D ioremap(res->start, resource_size(res)); if (fotg210->reg =3D=3D NULL) { pr_err("ioremap error.\n"); - goto err_map; + goto err_alloc; } =20 spin_lock_init(&fotg210->lock); @@ -1159,7 +1162,7 @@ static int fotg210_udc_probe(struct platform_device *= pdev) fotg210->ep0_req =3D fotg210_ep_alloc_request(&fotg210->ep[0]->ep, GFP_KERNEL); if (fotg210->ep0_req =3D=3D NULL) - goto err_req; + goto err_map; =20 fotg210_init(fotg210); =20 @@ -1187,12 +1190,14 @@ static int fotg210_udc_probe(struct platform_device= *pdev) fotg210_ep_free_request(&fotg210->ep[0]->ep, fotg210->ep0_req); =20 err_map: - if (fotg210->reg) - iounmap(fotg210->reg); + iounmap(fotg210->reg); =20 err_alloc: + for (i =3D 0; i < FOTG210_MAX_NUM_EP; i++) + kfree(fotg210->ep[i]); kfree(fotg210); =20 +err: return ret; } =20 --=20 2.17.1