Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d12a8727 authored by Pavitrakumar Managutte's avatar Pavitrakumar Managutte Committed by Felipe Balbi
Browse files

usb: gadget: function: Remove redundant usb_free_all_descriptors 



Removed usb_free_all_descriptors in the bind functions, which
results in double-free corruption of the descriptors on error path.
The usb descriptors are allocated by usb_assign_descriptors.

Signed-off-by: default avatarPavitrakumar Managutte <pavitra1729@gmail.com>
Reviewed-by: default avatarRobert Baldyga <r.baldyga@samsung.com>
Reviewed-by: default avatarSebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: default avatarFelipe Balbi <balbi@ti.com>
parent 1200a82a

drivers/usb/gadget/function/f_eem.c

+0 −1
Original line number Diff line number Diff line
@@ -325,7 +325,6 @@ static int eem_bind(struct usb_configuration *c, struct usb_function *f) 
	return 0;



fail:

	usb_free_all_descriptors(f);

	if (eem->port.out_ep)

		eem->port.out_ep->driver_data = NULL;

	if (eem->port.in_ep)

drivers/usb/gadget/function/f_hid.c

+3 −2
Original line number Diff line number Diff line
@@ -621,12 +621,14 @@ static int __init hidg_bind(struct usb_configuration *c, struct usb_function *f) 
	dev = MKDEV(major, hidg->minor);

	status = cdev_add(&hidg->cdev, dev, 1);

	if (status)

		goto fail;

		goto fail_free_descs;



	device_create(hidg_class, NULL, dev, NULL, "%s%d", "hidg", hidg->minor);



	return 0;



fail_free_descs:

	usb_free_all_descriptors(f);

fail:

	ERROR(f->config->cdev, "hidg_bind FAILED\n");

	if (hidg->req != NULL) {
@@ -635,7 +637,6 @@ static int __init hidg_bind(struct usb_configuration *c, struct usb_function *f) 
			usb_ep_free_request(hidg->in_ep, hidg->req);

	}



	usb_free_all_descriptors(f);

	return status;

}

drivers/usb/gadget/function/f_ncm.c

+0 −1
Original line number Diff line number Diff line
@@ -1461,7 +1461,6 @@ static int ncm_bind(struct usb_configuration *c, struct usb_function *f) 
	return 0;



fail:

	usb_free_all_descriptors(f);

	if (ncm->notify_req) {

		kfree(ncm->notify_req->buf);

		usb_ep_free_request(ncm->notify, ncm->notify_req);

drivers/usb/gadget/function/f_obex.c

+0 −1
Original line number Diff line number Diff line
@@ -397,7 +397,6 @@ static int obex_bind(struct usb_configuration *c, struct usb_function *f) 
	return 0;



fail:

	usb_free_all_descriptors(f);

	/* we might as well release our claims on endpoints */

	if (obex->port.out)

		obex->port.out->driver_data = NULL;

drivers/usb/gadget/function/f_phonet.c

+1 −1
Original line number Diff line number Diff line
@@ -570,8 +570,8 @@ static int pn_bind(struct usb_configuration *c, struct usb_function *f) 
err_req:

	for (i = 0; i < phonet_rxq_size && fp->out_reqv[i]; i++)

		usb_ep_free_request(fp->out_ep, fp->out_reqv[i]);

err:

	usb_free_all_descriptors(f);

err:

	if (fp->out_ep)

		fp->out_ep->driver_data = NULL;

	if (fp->in_ep)