Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9334367c authored by Ikjoon Jang's avatar Ikjoon Jang Committed by Greg Kroah-Hartman
Browse files

xhci: fix possible memleak on setup address fails. 



Xhci re-enables a slot on transaction error in set_address using
xhci_disable_slot() + xhci_alloc_dev().

But in this case, xhci_alloc_dev() creates debugfs entries upon an
existing device without cleaning up old entries, thus memory leaks.

So this patch simply moves calling xhci_debugfs_free_dev() from
xhci_free_dev() to xhci_disable_slot().

[added "possible" to header as this is about failure codepath -Mathias]
Signed-off-by: default avatarIkjoon Jang <ikjn@chromium.org>
Signed-off-by: default avatarMathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/1567172356-12915-5-git-send-email-mathias.nyman@linux.intel.com


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 8a62dff2

drivers/usb/host/xhci.c

+2 −1
Original line number Diff line number Diff line
@@ -3814,7 +3814,6 @@ static void xhci_free_dev(struct usb_hcd *hcd, struct usb_device *udev) 
		virt_dev->eps[i].ep_state &= ~EP_STOP_CMD_PENDING;

		del_timer_sync(&virt_dev->eps[i].stop_cmd_timer);

	}

	xhci_debugfs_remove_slot(xhci, udev->slot_id);

	virt_dev->udev = NULL;

	ret = xhci_disable_slot(xhci, udev->slot_id);

	if (ret)
@@ -3832,6 +3831,8 @@ int xhci_disable_slot(struct xhci_hcd *xhci, u32 slot_id) 
	if (!command)

		return -ENOMEM;



	xhci_debugfs_remove_slot(xhci, slot_id);



	spin_lock_irqsave(&xhci->lock, flags);

	/* Don't disable the slot if the host controller is dead. */

	state = readl(&xhci->op_regs->status);