lkml.org 
[lkml]   [2009]   [Jul]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[patch 07/37] USB: fix memleak in usbfs
    2.6.27-stable review patch.  If anyone has any objections, please let us know.

    ------------------

    From: Oliver Neukum <oliver@neukum.org>

    commit d794a02111cd3393da69bc7d6dd2b6074bd037cc upstream.

    This patch fixes a memory leak in devio.c::processcompl

    If writing to user space fails the packet must be discarded, as it
    already has been removed from the queue of completed packets.

    Signed-off-by: Oliver Neukum <oliver@neukum.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

    ---
    drivers/usb/core/devio.c | 16 ++++++++++------
    1 file changed, 10 insertions(+), 6 deletions(-)

    --- a/drivers/usb/core/devio.c
    +++ b/drivers/usb/core/devio.c
    @@ -1228,22 +1228,22 @@ static int processcompl(struct async *as
    if (as->userbuffer)
    if (copy_to_user(as->userbuffer, urb->transfer_buffer,
    urb->transfer_buffer_length))
    - return -EFAULT;
    + goto err_out;
    if (put_user(as->status, &userurb->status))
    - return -EFAULT;
    + goto err_out;
    if (put_user(urb->actual_length, &userurb->actual_length))
    - return -EFAULT;
    + goto err_out;
    if (put_user(urb->error_count, &userurb->error_count))
    - return -EFAULT;
    + goto err_out;

    if (usb_endpoint_xfer_isoc(&urb->ep->desc)) {
    for (i = 0; i < urb->number_of_packets; i++) {
    if (put_user(urb->iso_frame_desc[i].actual_length,
    &userurb->iso_frame_desc[i].actual_length))
    - return -EFAULT;
    + goto err_out;
    if (put_user(urb->iso_frame_desc[i].status,
    &userurb->iso_frame_desc[i].status))
    - return -EFAULT;
    + goto err_out;
    }
    }

    @@ -1252,6 +1252,10 @@ static int processcompl(struct async *as
    if (put_user(addr, (void __user * __user *)arg))
    return -EFAULT;
    return 0;
    +
    +err_out:
    + free_async(as);
    + return -EFAULT;
    }

    static struct async *reap_as(struct dev_state *ps)



    \
     
     \ /
      Last update: 2009-07-29 01:27    [W:4.231 / U:0.068 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site