lkml.org 
[lkml]   [2009]   [Oct]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
Subject[048/136] kaweth: Fix memory leak in kaweth_control()
2.6.31-stable review patch.  If anyone has any objections, please let us know.

------------------
From: Kevin Cernekee <cernekee@gmail.com>
commit 051b982bcc620695de629d29c333c95b66e9b95e upstream.

kaweth_control() never frees the buffer that it allocates for the USB
control message. Test case:

while :; do ifconfig eth2 down ; ifconfig eth2 up ; done

This is a tiny buffer so it is a slow leak. If you want to speed up the
process, you can change the allocation size to e.g. 16384 bytes, and it
will consume several megabytes within a few minutes.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
Acked-by: Oliver Neukum <oliver@neukum.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

---
drivers/net/usb/kaweth.c | 18 +++++++++++-------
1 file changed, 11 insertions(+), 7 deletions(-)
--- a/drivers/net/usb/kaweth.c
+++ b/drivers/net/usb/kaweth.c
@@ -263,6 +263,7 @@ static int kaweth_control(struct kaweth_
int timeout)
{
struct usb_ctrlrequest *dr;
+ int retval;

dbg("kaweth_control()");

@@ -278,18 +279,21 @@ static int kaweth_control(struct kaweth_
return -ENOMEM;
}

- dr->bRequestType= requesttype;
+ dr->bRequestType = requesttype;
dr->bRequest = request;
dr->wValue = cpu_to_le16(value);
dr->wIndex = cpu_to_le16(index);
dr->wLength = cpu_to_le16(size);

- return kaweth_internal_control_msg(kaweth->dev,
- pipe,
- dr,
- data,
- size,
- timeout);
+ retval = kaweth_internal_control_msg(kaweth->dev,
+ pipe,
+ dr,
+ data,
+ size,
+ timeout);
+
+ kfree(dr);
+ return retval;
}

/****************************************************************



\
 
 \ /
  Last update: 2009-10-02 03:39    [from the cache]
©2003-2011 Jasper Spaans