lkml.org 
[lkml]   [2011]   [Mar]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[GIT PATCH 2/3] Resend : Fix memory leak in qcserial driver
    Patch 2 of 3, addresses the problem where serial->private can end up pointing to freed memory in the event qcprobe fails & returns -ENODEV

    Original description:
    3 - Don't assign serial->private when doing the kzalloc or serial->private ends up pointing to freed memory in the event we return -ENODEV, instead call usb_set_serial_data(serial, data) at the end of the function, and only have one return-point.


    Signed-off-by: Steve Hardy <shardy@redhat.com>


    diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
    index 6e3b933..0463dab 100644
    --- a/drivers/usb/serial/qcserial.c
    +++ b/drivers/usb/serial/qcserial.c
    @@ -111,7 +111,7 @@ static int qcprobe(struct usb_serial *serial, const struct usb_device_id *id)
    ifnum = intf->desc.bInterfaceNumber;
    dbg("This Interface = %d", ifnum);

    - data = serial->private = kzalloc(sizeof(struct usb_wwan_intf_private),
    + data = kzalloc(sizeof(struct usb_wwan_intf_private),
    GFP_KERNEL);
    if (!data)
    return -ENOMEM;
    @@ -134,8 +134,10 @@ static int qcprobe(struct usb_serial *serial, const struct usb_device_id *id)
    usb_endpoint_is_bulk_out(&intf->endpoint[1].desc)) {
    dbg("QDL port found");

    - if (serial->interface->num_altsetting == 1)
    - return 0;
    + if (serial->interface->num_altsetting == 1) {
    + retval = 0; /* Success */
    + break;
    + }

    retval = usb_set_interface(serial->dev, ifnum, 1);
    if (retval < 0) {
    @@ -145,7 +147,6 @@ static int qcprobe(struct usb_serial *serial, const struct usb_device_id *id)
    retval = -ENODEV;
    kfree(data);
    }
    - return retval;
    }
    break;

    @@ -177,7 +178,6 @@ static int qcprobe(struct usb_serial *serial, const struct usb_device_id *id)
    retval = -ENODEV;
    kfree(data);
    }
    - return retval;
    } else if (ifnum==3) {
    /*
    * NMEA (serial line 9600 8N1)
    @@ -199,9 +199,11 @@ static int qcprobe(struct usb_serial *serial, const struct usb_device_id *id)
    dev_err(&serial->dev->dev,
    "unknown number of interfaces: %d\n", nintf);
    kfree(data);
    - return -ENODEV;
    + retval = -ENODEV;
    }

    + /* Set serial->private may be null if -ENODEV */
    + usb_set_serial_data(serial, data);
    return retval;
    }


    \
     
     \ /
      Last update: 2011-03-28 19:41    [W:0.048 / U:91.920 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site