usb-whiteheat-fix-memory-leak-in-error-path.patch
usb-opticon-fix-dma-from-stack.patch
usb-opticon-fix-memory-leak-in-error-path.patch
+usb-serial-fix-memory-leak-in-sierra_release.patch
+usb-sierra-fix-memory-leak-in-attach-error-path.patch
+usb-sierra-fix-memory-leak-in-probe-error-path.patch
+usb-mos7840-fix-urb-leak-at-release.patch
+usb-mos7840-fix-port-device-leak-in-error-path.patch
+usb-mos7840-remove-null-urb-submission.patch
+usb-mos7840-remove-invalid-disconnect-handling.patch
--- /dev/null
+From 3eb55cc4ed88eee3b5230f66abcdbd2a91639eda Mon Sep 17 00:00:00 2001
+From: Johan Hovold <jhovold@gmail.com>
+Date: Thu, 25 Oct 2012 13:35:10 +0200
+Subject: USB: mos7840: fix port-device leak in error path
+
+From: Johan Hovold <jhovold@gmail.com>
+
+commit 3eb55cc4ed88eee3b5230f66abcdbd2a91639eda upstream.
+
+The driver set the usb-serial port pointers to NULL on errors in attach,
+effectively preventing usb-serial core from decrementing the port ref
+counters and releasing the port devices and associated data.
+
+Signed-off-by: Johan Hovold <jhovold@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/mos7840.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/usb/serial/mos7840.c
++++ b/drivers/usb/serial/mos7840.c
+@@ -2590,7 +2590,6 @@ error:
+ kfree(mos7840_port->ctrl_buf);
+ usb_free_urb(mos7840_port->control_urb);
+ kfree(mos7840_port);
+- serial->port[i] = NULL;
+ }
+ return status;
+ }
--- /dev/null
+From 65a4cdbb170e4ec1a7fa0e94936d47e24a17b0e8 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <jhovold@gmail.com>
+Date: Thu, 25 Oct 2012 13:35:09 +0200
+Subject: USB: mos7840: fix urb leak at release
+
+From: Johan Hovold <jhovold@gmail.com>
+
+commit 65a4cdbb170e4ec1a7fa0e94936d47e24a17b0e8 upstream.
+
+Make sure control urb is freed at release.
+
+Signed-off-by: Johan Hovold <jhovold@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/mos7840.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/serial/mos7840.c
++++ b/drivers/usb/serial/mos7840.c
+@@ -2657,6 +2657,7 @@ static void mos7840_release(struct usb_s
+ mos7840_port = mos7840_get_port_private(serial->port[i]);
+ dbg("mos7840_port %d = %p", i, mos7840_port);
+ if (mos7840_port) {
++ usb_free_urb(mos7840_port->control_urb);
+ kfree(mos7840_port->ctrl_buf);
+ kfree(mos7840_port->dr);
+ kfree(mos7840_port);
--- /dev/null
+From e681b66f2e19fadbe8a7e2a17900978cb6bc921f Mon Sep 17 00:00:00 2001
+From: Johan Hovold <jhovold@gmail.com>
+Date: Thu, 25 Oct 2012 18:56:33 +0200
+Subject: USB: mos7840: remove invalid disconnect handling
+
+From: Johan Hovold <jhovold@gmail.com>
+
+commit e681b66f2e19fadbe8a7e2a17900978cb6bc921f upstream.
+
+Remove private zombie flag used to signal disconnect and to prevent
+control urb from being submitted from interrupt urb completion handler.
+
+The control urb will not be re-submitted as both the control urb and the
+interrupt urb is killed on disconnect.
+
+Signed-off-by: Johan Hovold <jhovold@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/mos7840.c | 13 +------------
+ 1 file changed, 1 insertion(+), 12 deletions(-)
+
+--- a/drivers/usb/serial/mos7840.c
++++ b/drivers/usb/serial/mos7840.c
+@@ -239,7 +239,6 @@ struct moschip_port {
+ __u8 shadowMCR; /* last MCR value received */
+ char open;
+ char open_ports;
+- char zombie;
+ wait_queue_head_t wait_chase; /* for handling sleeping while waiting for chase to finish */
+ wait_queue_head_t delta_msr_wait; /* for handling sleeping while waiting for msr change to happen */
+ int delta_msr_cond;
+@@ -642,14 +641,7 @@ static void mos7840_interrupt_callback(s
+ wreg = MODEM_STATUS_REGISTER;
+ break;
+ }
+- spin_lock(&mos7840_port->pool_lock);
+- if (!mos7840_port->zombie) {
+- rv = mos7840_get_reg(mos7840_port, wval, wreg, &Data);
+- } else {
+- spin_unlock(&mos7840_port->pool_lock);
+- return;
+- }
+- spin_unlock(&mos7840_port->pool_lock);
++ rv = mos7840_get_reg(mos7840_port, wval, wreg, &Data);
+ }
+ }
+ }
+@@ -2607,9 +2599,6 @@ static void mos7840_disconnect(struct us
+ mos7840_port = mos7840_get_port_private(serial->port[i]);
+ dbg ("mos7840_port %d = %p", i, mos7840_port);
+ if (mos7840_port) {
+- spin_lock_irqsave(&mos7840_port->pool_lock, flags);
+- mos7840_port->zombie = 1;
+- spin_unlock_irqrestore(&mos7840_port->pool_lock, flags);
+ usb_kill_urb(mos7840_port->control_urb);
+ }
+ }
--- /dev/null
+From 28c3ae9a8cf45f439c9a0779ebd0256e2ae72813 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <jhovold@gmail.com>
+Date: Thu, 25 Oct 2012 18:56:32 +0200
+Subject: USB: mos7840: remove NULL-urb submission
+
+From: Johan Hovold <jhovold@gmail.com>
+
+commit 28c3ae9a8cf45f439c9a0779ebd0256e2ae72813 upstream.
+
+The private int_urb is never allocated so the submission from the
+control completion handler will always fail. Remove this odd piece of
+broken code.
+
+Signed-off-by: Johan Hovold <jhovold@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/mos7840.c | 15 +--------------
+ 1 file changed, 1 insertion(+), 14 deletions(-)
+
+--- a/drivers/usb/serial/mos7840.c
++++ b/drivers/usb/serial/mos7840.c
+@@ -235,7 +235,6 @@ struct moschip_port {
+ int port_num; /*Actual port number in the device(1,2,etc) */
+ struct urb *write_urb; /* write URB for this port */
+ struct urb *read_urb; /* read URB for this port */
+- struct urb *int_urb;
+ __u8 shadowLCR; /* last LCR value received */
+ __u8 shadowMCR; /* last MCR value received */
+ char open;
+@@ -505,7 +504,6 @@ static void mos7840_control_callback(str
+ unsigned char *data;
+ struct moschip_port *mos7840_port;
+ __u8 regval = 0x0;
+- int result = 0;
+ int status = urb->status;
+
+ mos7840_port = urb->context;
+@@ -524,7 +522,7 @@ static void mos7840_control_callback(str
+ default:
+ dbg("%s - nonzero urb status received: %d", __func__,
+ status);
+- goto exit;
++ return;
+ }
+
+ dbg("%s urb buffer size is %d", __func__, urb->actual_length);
+@@ -537,17 +535,6 @@ static void mos7840_control_callback(str
+ mos7840_handle_new_msr(mos7840_port, regval);
+ else if (mos7840_port->MsrLsr == 1)
+ mos7840_handle_new_lsr(mos7840_port, regval);
+-
+-exit:
+- spin_lock(&mos7840_port->pool_lock);
+- if (!mos7840_port->zombie)
+- result = usb_submit_urb(mos7840_port->int_urb, GFP_ATOMIC);
+- spin_unlock(&mos7840_port->pool_lock);
+- if (result) {
+- dev_err(&urb->dev->dev,
+- "%s - Error %d submitting interrupt urb\n",
+- __func__, result);
+- }
+ }
+
+ static int mos7840_get_reg(struct moschip_port *mcs, __u16 Wval, __u16 reg,
--- /dev/null
+From f7bc5051667b74c3861f79eed98c60d5c3b883f7 Mon Sep 17 00:00:00 2001
+From: Lennart Sorensen <lsorense@csclub.uwaterloo.ca>
+Date: Wed, 24 Oct 2012 10:23:09 -0400
+Subject: USB: serial: Fix memory leak in sierra_release()
+
+From: Lennart Sorensen <lsorense@csclub.uwaterloo.ca>
+
+commit f7bc5051667b74c3861f79eed98c60d5c3b883f7 upstream.
+
+I found a memory leak in sierra_release() (well sierra_probe() I guess)
+that looses 8 bytes each time the driver releases a device.
+
+Signed-off-by: Len Sorensen <lsorense@csclub.uwaterloo.ca>
+Acked-by: Johan Hovold <jhovold@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/sierra.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/usb/serial/sierra.c
++++ b/drivers/usb/serial/sierra.c
+@@ -992,6 +992,7 @@ static void sierra_release(struct usb_se
+ continue;
+ kfree(portdata);
+ }
++ kfree(serial->private);
+ }
+
+ #ifdef CONFIG_PM
--- /dev/null
+From 7e41f9bcdd2e813ea2a3c40db291d87ea06b559f Mon Sep 17 00:00:00 2001
+From: Johan Hovold <jhovold@gmail.com>
+Date: Thu, 25 Oct 2012 10:29:17 +0200
+Subject: USB: sierra: fix memory leak in attach error path
+
+From: Johan Hovold <jhovold@gmail.com>
+
+commit 7e41f9bcdd2e813ea2a3c40db291d87ea06b559f upstream.
+
+Make sure port private data is deallocated on errors in attach.
+
+Signed-off-by: Johan Hovold <jhovold@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/sierra.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/drivers/usb/serial/sierra.c
++++ b/drivers/usb/serial/sierra.c
+@@ -936,7 +936,7 @@ static int sierra_startup(struct usb_ser
+ dev_dbg(&port->dev, "%s: kmalloc for "
+ "sierra_port_private (%d) failed!\n",
+ __func__, i);
+- return -ENOMEM;
++ goto err;
+ }
+ spin_lock_init(&portdata->lock);
+ init_usb_anchor(&portdata->active);
+@@ -973,6 +973,13 @@ static int sierra_startup(struct usb_ser
+ }
+
+ return 0;
++err:
++ for (--i; i >= 0; --i) {
++ portdata = usb_get_serial_port_data(serial->port[i]);
++ kfree(portdata);
++ }
++
++ return -ENOMEM;
+ }
+
+ static void sierra_release(struct usb_serial *serial)
--- /dev/null
+From 084817d79399ab5ccab2f90a148b0369912a8369 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <jhovold@gmail.com>
+Date: Thu, 25 Oct 2012 10:29:18 +0200
+Subject: USB: sierra: fix memory leak in probe error path
+
+From: Johan Hovold <jhovold@gmail.com>
+
+commit 084817d79399ab5ccab2f90a148b0369912a8369 upstream.
+
+Move interface data allocation to attach so that it is deallocated on
+errors in usb-serial probe.
+
+Signed-off-by: Johan Hovold <jhovold@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/sierra.c | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+--- a/drivers/usb/serial/sierra.c
++++ b/drivers/usb/serial/sierra.c
+@@ -171,7 +171,6 @@ static int sierra_probe(struct usb_seria
+ {
+ int result = 0;
+ struct usb_device *udev;
+- struct sierra_intf_private *data;
+ u8 ifnum;
+
+ udev = serial->dev;
+@@ -199,11 +198,6 @@ static int sierra_probe(struct usb_seria
+ return -ENODEV;
+ }
+
+- data = serial->private = kzalloc(sizeof(struct sierra_intf_private), GFP_KERNEL);
+- if (!data)
+- return -ENOMEM;
+- spin_lock_init(&data->susp_lock);
+-
+ return result;
+ }
+
+@@ -914,6 +908,7 @@ static void sierra_dtr_rts(struct usb_se
+ static int sierra_startup(struct usb_serial *serial)
+ {
+ struct usb_serial_port *port;
++ struct sierra_intf_private *intfdata;
+ struct sierra_port_private *portdata;
+ struct sierra_iface_info *himemoryp = NULL;
+ int i;
+@@ -921,6 +916,14 @@ static int sierra_startup(struct usb_ser
+
+ dev_dbg(&serial->dev->dev, "%s\n", __func__);
+
++ intfdata = kzalloc(sizeof(*intfdata), GFP_KERNEL);
++ if (!intfdata)
++ return -ENOMEM;
++
++ spin_lock_init(&intfdata->susp_lock);
++
++ usb_set_serial_data(serial, intfdata);
++
+ /* Set Device mode to D0 */
+ sierra_set_power_state(serial->dev, 0x0000);
+
+@@ -978,6 +981,7 @@ err:
+ portdata = usb_get_serial_port_data(serial->port[i]);
+ kfree(portdata);
+ }
++ kfree(intfdata);
+
+ return -ENOMEM;
+ }
projects / thirdparty / kernel / stable-queue.git / commitdiff
