releases/4.14.124/usb-rio500-fix-memory-leak-in-close-after-disconnect.patch

   1 From e0feb73428b69322dd5caae90b0207de369b5575 Mon Sep 17 00:00:00 2001
   2 From: Oliver Neukum <oneukum@suse.com>
   3 Date: Thu, 9 May 2019 11:30:59 +0200
   4 Subject: USB: rio500: fix memory leak in close after disconnect
   5
   6 From: Oliver Neukum <oneukum@suse.com>
   7
   8 commit e0feb73428b69322dd5caae90b0207de369b5575 upstream.
   9
  10 If a disconnected device is closed, rio_close() must free
  11 the buffers.
  12
  13 Signed-off-by: Oliver Neukum <oneukum@suse.com>
  14 Cc: stable <stable@vger.kernel.org>
  15 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  16
  17 ---
  18  drivers/usb/misc/rio500.c |   17 +++++++++++++++--
  19  1 file changed, 15 insertions(+), 2 deletions(-)
  20
  21 --- a/drivers/usb/misc/rio500.c
  22 +++ b/drivers/usb/misc/rio500.c
  23 @@ -99,9 +99,22 @@ static int close_rio(struct inode *inode
  24  {
  25         struct rio_usb_data *rio = &rio_instance;
  26
  27 -       rio->isopen = 0;
  28 +       /* against disconnect() */
  29 +       mutex_lock(&rio500_mutex);
  30 +       mutex_lock(&(rio->lock));
  31
  32 -       dev_info(&rio->rio_dev->dev, "Rio closed.\n");
  33 +       rio->isopen = 0;
  34 +       if (!rio->present) {
  35 +               /* cleanup has been delayed */
  36 +               kfree(rio->ibuf);
  37 +               kfree(rio->obuf);
  38 +               rio->ibuf = NULL;
  39 +               rio->obuf = NULL;
  40 +       } else {
  41 +               dev_info(&rio->rio_dev->dev, "Rio closed.\n");
  42 +       }
  43 +       mutex_unlock(&(rio->lock));
  44 +       mutex_unlock(&rio500_mutex);
  45         return 0;
  46  }
  47