releases/4.9.132/usb-gadget-fotg210-udc-fix-memory-leak-of-fotg210-ep.patch

   1 From foo@baz Mon Oct  8 18:01:43 CEST 2018
   2 From: Anton Vasilyev <vasilyev@ispras.ru>
   3 Date: Tue, 7 Aug 2018 14:44:48 +0300
   4 Subject: usb: gadget: fotg210-udc: Fix memory leak of fotg210->ep[i]
   5
   6 From: Anton Vasilyev <vasilyev@ispras.ru>
   7
   8 [ Upstream commit c37bd52836296ecc9a0fc8060b819089aebdbcde ]
   9
  10 There is no deallocation of fotg210->ep[i] elements, allocated at
  11 fotg210_udc_probe.
  12
  13 The patch adds deallocation of fotg210->ep array elements and simplifies
  14 error path of fotg210_udc_probe().
  15
  16 Found by Linux Driver Verification project (linuxtesting.org).
  17
  18 Signed-off-by: Anton Vasilyev <vasilyev@ispras.ru>
  19 Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
  20 Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
  21 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  22 ---
  23  drivers/usb/gadget/udc/fotg210-udc.c |   15 ++++++++++-----
  24  1 file changed, 10 insertions(+), 5 deletions(-)
  25
  26 --- a/drivers/usb/gadget/udc/fotg210-udc.c
  27 +++ b/drivers/usb/gadget/udc/fotg210-udc.c
  28 @@ -1066,12 +1066,15 @@ static struct usb_gadget_ops fotg210_gad
  29  static int fotg210_udc_remove(struct platform_device *pdev)
  30  {
  31         struct fotg210_udc *fotg210 = platform_get_drvdata(pdev);
  32 +       int i;
  33
  34         usb_del_gadget_udc(&fotg210->gadget);
  35         iounmap(fotg210->reg);
  36         free_irq(platform_get_irq(pdev, 0), fotg210);
  37
  38         fotg210_ep_free_request(&fotg210->ep[0]->ep, fotg210->ep0_req);
  39 +       for (i = 0; i < FOTG210_MAX_NUM_EP; i++)
  40 +               kfree(fotg210->ep[i]);
  41         kfree(fotg210);
  42
  43         return 0;
  44 @@ -1102,7 +1105,7 @@ static int fotg210_udc_probe(struct plat
  45         /* initialize udc */
  46         fotg210 = kzalloc(sizeof(struct fotg210_udc), GFP_KERNEL);
  47         if (fotg210 == NULL)
  48 -               goto err_alloc;
  49 +               goto err;
  50
  51         for (i = 0; i < FOTG210_MAX_NUM_EP; i++) {
  52                 _ep[i] = kzalloc(sizeof(struct fotg210_ep), GFP_KERNEL);
  53 @@ -1114,7 +1117,7 @@ static int fotg210_udc_probe(struct plat
  54         fotg210->reg = ioremap(res->start, resource_size(res));
  55         if (fotg210->reg == NULL) {
  56                 pr_err("ioremap error.\n");
  57 -               goto err_map;
  58 +               goto err_alloc;
  59         }
  60
  61         spin_lock_init(&fotg210->lock);
  62 @@ -1162,7 +1165,7 @@ static int fotg210_udc_probe(struct plat
  63         fotg210->ep0_req = fotg210_ep_alloc_request(&fotg210->ep[0]->ep,
  64                                 GFP_KERNEL);
  65         if (fotg210->ep0_req == NULL)
  66 -               goto err_req;
  67 +               goto err_map;
  68
  69         fotg210_init(fotg210);
  70
  71 @@ -1190,12 +1193,14 @@ err_req:
  72         fotg210_ep_free_request(&fotg210->ep[0]->ep, fotg210->ep0_req);
  73
  74  err_map:
  75 -       if (fotg210->reg)
  76 -               iounmap(fotg210->reg);
  77 +       iounmap(fotg210->reg);
  78
  79  err_alloc:
  80 +       for (i = 0; i < FOTG210_MAX_NUM_EP; i++)
  81 +               kfree(fotg210->ep[i]);
  82         kfree(fotg210);
  83
  84 +err:
  85         return ret;
  86  }
  87