+++ /dev/null
-From foo@baz Mon Oct 8 17:34:37 CEST 2018
-From: Anton Vasilyev <vasilyev@ispras.ru>
-Date: Tue, 7 Aug 2018 14:44:48 +0300
-Subject: usb: gadget: fotg210-udc: Fix memory leak of fotg210->ep[i]
-
-From: Anton Vasilyev <vasilyev@ispras.ru>
-
-[ Upstream commit c37bd52836296ecc9a0fc8060b819089aebdbcde ]
-
-There is no deallocation of fotg210->ep[i] elements, allocated at
-fotg210_udc_probe.
-
-The patch adds deallocation of fotg210->ep array elements and simplifies
-error path of fotg210_udc_probe().
-
-Found by Linux Driver Verification project (linuxtesting.org).
-
-Signed-off-by: Anton Vasilyev <vasilyev@ispras.ru>
-Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
-Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
----
- drivers/usb/gadget/udc/fotg210-udc.c | 15 ++++++++++-----
- 1 file changed, 10 insertions(+), 5 deletions(-)
-
---- a/drivers/usb/gadget/udc/fotg210-udc.c
-+++ b/drivers/usb/gadget/udc/fotg210-udc.c
-@@ -1077,12 +1077,15 @@ static struct usb_gadget_ops fotg210_gad
- static int fotg210_udc_remove(struct platform_device *pdev)
- {
- struct fotg210_udc *fotg210 = platform_get_drvdata(pdev);
-+ int i;
-
- usb_del_gadget_udc(&fotg210->gadget);
- iounmap(fotg210->reg);
- free_irq(platform_get_irq(pdev, 0), fotg210);
-
- fotg210_ep_free_request(&fotg210->ep[0]->ep, fotg210->ep0_req);
-+ for (i = 0; i < FOTG210_MAX_NUM_EP; i++)
-+ kfree(fotg210->ep[i]);
- kfree(fotg210);
-
- return 0;
-@@ -1113,7 +1116,7 @@ static int fotg210_udc_probe(struct plat
- /* initialize udc */
- fotg210 = kzalloc(sizeof(struct fotg210_udc), GFP_KERNEL);
- if (fotg210 == NULL)
-- goto err_alloc;
-+ goto err;
-
- for (i = 0; i < FOTG210_MAX_NUM_EP; i++) {
- _ep[i] = kzalloc(sizeof(struct fotg210_ep), GFP_KERNEL);
-@@ -1125,7 +1128,7 @@ static int fotg210_udc_probe(struct plat
- fotg210->reg = ioremap(res->start, resource_size(res));
- if (fotg210->reg == NULL) {
- pr_err("ioremap error.\n");
-- goto err_map;
-+ goto err_alloc;
- }
-
- spin_lock_init(&fotg210->lock);
-@@ -1162,7 +1165,7 @@ static int fotg210_udc_probe(struct plat
- fotg210->ep0_req = fotg210_ep_alloc_request(&fotg210->ep[0]->ep,
- GFP_KERNEL);
- if (fotg210->ep0_req == NULL)
-- goto err_req;
-+ goto err_map;
-
- fotg210_init(fotg210);
-
-@@ -1191,12 +1194,14 @@ err_req:
- fotg210_ep_free_request(&fotg210->ep[0]->ep, fotg210->ep0_req);
-
- err_map:
-- if (fotg210->reg)
-- iounmap(fotg210->reg);
-+ iounmap(fotg210->reg);
-
- err_alloc:
-+ for (i = 0; i < FOTG210_MAX_NUM_EP; i++)
-+ kfree(fotg210->ep[i]);
- kfree(fotg210);
-
-+err:
- return ret;
- }
-