Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d794a021 authored by Oliver Neukum's avatar Oliver Neukum Committed by Greg Kroah-Hartman
Browse files

USB: fix memleak in usbfs 



This patch fixes a memory leak in devio.c::processcompl

If writing to user space fails the packet must be discarded, as it
already has been removed from the queue of completed packets.

Signed-off-by: default avatarOliver Neukum <oliver@neukum.org>
Cc: stable <stable@kernel.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
parent ba516de3

drivers/usb/core/devio.c

+10 −6
Original line number Diff line number Diff line
@@ -1231,22 +1231,22 @@ static int processcompl(struct async *as, void __user * __user *arg) 
	if (as->userbuffer)

		if (copy_to_user(as->userbuffer, urb->transfer_buffer,

				 urb->transfer_buffer_length))

			return -EFAULT;

			goto err_out;

	if (put_user(as->status, &userurb->status))

		return -EFAULT;

		goto err_out;

	if (put_user(urb->actual_length, &userurb->actual_length))

		return -EFAULT;

		goto err_out;

	if (put_user(urb->error_count, &userurb->error_count))

		return -EFAULT;

		goto err_out;



	if (usb_endpoint_xfer_isoc(&urb->ep->desc)) {

		for (i = 0; i < urb->number_of_packets; i++) {

			if (put_user(urb->iso_frame_desc[i].actual_length,

				     &userurb->iso_frame_desc[i].actual_length))

				return -EFAULT;

				goto err_out;

			if (put_user(urb->iso_frame_desc[i].status,

				     &userurb->iso_frame_desc[i].status))

				return -EFAULT;

				goto err_out;

		}

	}
@@ -1255,6 +1255,10 @@ static int processcompl(struct async *as, void __user * __user *arg) 
	if (put_user(addr, (void __user * __user *)arg))

		return -EFAULT;

	return 0;



err_out:

	free_async(as);

	return -EFAULT;

}



static struct async *reap_as(struct dev_state *ps)