lkml.org 
[lkml]   [2018]   [Feb]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Date
    Subject[PATCH 3.16 192/254] USB: Gadget core: fix inconsistency in the interface tousb_add_gadget_udc_release()
    3.16.55-rc1 review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Alan Stern <stern@rowland.harvard.edu>

    commit afd7fd81f22bf90474216515dbd6088f9bd70343 upstream.

    The usb_add_gadget_udc_release() routine in the USB gadget core will
    sometimes but not always call the gadget's release function when an
    error occurs. More specifically, if the struct usb_udc allocation
    fails then the release function is not called, and for other errors it
    is.

    As a result, users of this routine cannot know whether they need to
    deallocate the memory containing the gadget structure following an
    error. This leads to unavoidable memory leaks or double frees.

    This patch fixes the problem by splitting the existing
    device_register() call into device_initialize() and device_add(), and
    doing the udc allocation in between. That way, even if the allocation
    fails it is still possible to call device_del(), and so the release
    function will be always called following an error.

    Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
    Reported-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
    Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
    [bwh: Backported to 3.16: adjust filename]
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    ---
    drivers/usb/gadget/udc-core.c | 15 +++++++++------
    1 file changed, 9 insertions(+), 6 deletions(-)

    --- a/drivers/usb/gadget/udc-core.c
    +++ b/drivers/usb/gadget/udc-core.c
    @@ -192,6 +192,7 @@ static void usb_udc_nop_release(struct d
    * @release: a gadget release function.
    *
    * Returns zero on success, negative errno otherwise.
    + * Calls the gadget release function in the latter case.
    */
    int usb_add_gadget_udc_release(struct device *parent, struct usb_gadget *gadget,
    void (*release)(struct device *dev))
    @@ -199,10 +200,6 @@ int usb_add_gadget_udc_release(struct de
    struct usb_udc *udc;
    int ret = -ENOMEM;

    - udc = kzalloc(sizeof(*udc), GFP_KERNEL);
    - if (!udc)
    - goto err1;
    -
    dev_set_name(&gadget->dev, "gadget");
    INIT_WORK(&gadget->work, usb_gadget_state_work);
    gadget->dev.parent = parent;
    @@ -218,7 +215,13 @@ int usb_add_gadget_udc_release(struct de
    else
    gadget->dev.release = usb_udc_nop_release;

    - ret = device_register(&gadget->dev);
    + device_initialize(&gadget->dev);
    +
    + udc = kzalloc(sizeof(*udc), GFP_KERNEL);
    + if (!udc)
    + goto err1;
    +
    + ret = device_add(&gadget->dev);
    if (ret)
    goto err2;

    @@ -255,10 +258,10 @@ err3:
    device_del(&gadget->dev);

    err2:
    - put_device(&gadget->dev);
    kfree(udc);

    err1:
    + put_device(&gadget->dev);
    return ret;
    }
    EXPORT_SYMBOL_GPL(usb_add_gadget_udc_release);
    \
     
     \ /
      Last update: 2018-02-28 17:19    [W:4.080 / U:0.020 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site