Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 246603c0 authored by Pavel Skripkin's avatar Pavel Skripkin Committed by Greg Kroah-Hartman
Browse files

USB: serial: io_edgeport: fix memory leak in edge_startup 



commit cfdc67acc785e01a8719eeb7012709d245564701 upstream.

sysbot found memory leak in edge_startup().
The problem was that when an error was received from the usb_submit_urb(),
nothing was cleaned up.

Reported-by: default avatar <syzbot+59f777bdcbdd7eea5305@syzkaller.appspotmail.com>
Signed-off-by: default avatarPavel Skripkin <paskripkin@gmail.com>
Fixes: 6e8cf775 ("USB: add EPIC support to the io_edgeport driver")
Cc: stable@vger.kernel.org	# 2.6.21: c5c0c555
Signed-off-by: default avatarJohan Hovold <johan@kernel.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent fb90a661

drivers/usb/serial/io_edgeport.c

+16 −10
Original line number Diff line number Diff line
@@ -2959,25 +2959,31 @@ static int edge_startup(struct usb_serial *serial) 
				response = -ENODEV;

			}



			usb_free_urb(edge_serial->interrupt_read_urb);

			kfree(edge_serial->interrupt_in_buffer);



			usb_free_urb(edge_serial->read_urb);

			kfree(edge_serial->bulk_in_buffer);



			kfree(edge_serial);



			return response;

			goto error;

		}



		/* start interrupt read for this edgeport this interrupt will

		 * continue as long as the edgeport is connected */

		response = usb_submit_urb(edge_serial->interrupt_read_urb,

								GFP_KERNEL);

		if (response)

		if (response) {

			dev_err(ddev, "%s - Error %d submitting control urb\n",

				__func__, response);



			goto error;

		}

	}

	return response;



error:

	usb_free_urb(edge_serial->interrupt_read_urb);

	kfree(edge_serial->interrupt_in_buffer);



	usb_free_urb(edge_serial->read_urb);

	kfree(edge_serial->bulk_in_buffer);



	kfree(edge_serial);



	return response;

}