From 34760dbbcc560d38fdb1c1e57572a965c2f8aca5 Mon Sep 17 00:00:00 2001 From: Johan Hovold Date: Thu, 1 Jun 2017 04:45:59 -0300 Subject: [PATCH] mceusb: fix memory leaks in error path commit 2d5a6ce71c72d98d4f7948672842e3e8c265a8b7 upstream. Fix urb and transfer-buffer leaks in an urb-submission error path which may be hit when a device is disconnected. Fixes: 66e89522aff7 ("V4L/DVB: IR: add mceusb IR receiver driver") Cc: Jarod Wilson Signed-off-by: Johan Hovold Signed-off-by: Sean Young Signed-off-by: Mauro Carvalho Chehab [bwh: Backported to 3.2: - Add check on urb_type, as async_buf and async_urb aren't always allocated - Adjust context] Signed-off-by: Ben Hutchings --- drivers/media/rc/mceusb.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/media/rc/mceusb.c b/drivers/media/rc/mceusb.c index 2fb6473856a03..6e7468e394305 100644 --- a/drivers/media/rc/mceusb.c +++ b/drivers/media/rc/mceusb.c @@ -739,6 +739,7 @@ static void mce_request_packet(struct mceusb_dev *ir, unsigned char *data, } else if (urb_type == MCEUSB_RX) { /* standard request */ async_urb = ir->urb_in; + async_buf = NULL; ir->send_flags = RECV_FLAG_IN_PROGRESS; } else { @@ -754,6 +755,10 @@ static void mce_request_packet(struct mceusb_dev *ir, unsigned char *data, res = usb_submit_urb(async_urb, GFP_ATOMIC); if (res) { mce_dbg(dev, "receive request FAILED! (res=%d)\n", res); + if (urb_type == MCEUSB_TX) { + kfree(async_buf); + usb_free_urb(async_urb); + } return; } mce_dbg(dev, "receive request complete (res=%d)\n", res); -- 2.47.2