Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 81c823c2 authored by Anton Vasilyev's avatar Anton Vasilyev Committed by Greg Kroah-Hartman
Browse files

usb: gadget: fotg210-udc: Fix memory leak of fotg210->ep[i] 



[ Upstream commit c37bd52836296ecc9a0fc8060b819089aebdbcde ]

There is no deallocation of fotg210->ep[i] elements, allocated at
fotg210_udc_probe.

The patch adds deallocation of fotg210->ep array elements and simplifies
error path of fotg210_udc_probe().

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: default avatarAnton Vasilyev <vasilyev@ispras.ru>
Signed-off-by: default avatarFelipe Balbi <felipe.balbi@linux.intel.com>
Signed-off-by: default avatarSasha Levin <alexander.levin@microsoft.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent b6cc0ba2

drivers/usb/gadget/udc/fotg210-udc.c

+10 −5
Original line number Diff line number Diff line
@@ -1066,12 +1066,15 @@ static const struct usb_gadget_ops fotg210_gadget_ops = { 
static int fotg210_udc_remove(struct platform_device *pdev)

{

	struct fotg210_udc *fotg210 = platform_get_drvdata(pdev);

	int i;



	usb_del_gadget_udc(&fotg210->gadget);

	iounmap(fotg210->reg);

	free_irq(platform_get_irq(pdev, 0), fotg210);



	fotg210_ep_free_request(&fotg210->ep[0]->ep, fotg210->ep0_req);

	for (i = 0; i < FOTG210_MAX_NUM_EP; i++)

		kfree(fotg210->ep[i]);

	kfree(fotg210);



	return 0;
@@ -1102,7 +1105,7 @@ static int fotg210_udc_probe(struct platform_device *pdev) 
	/* initialize udc */

	fotg210 = kzalloc(sizeof(struct fotg210_udc), GFP_KERNEL);

	if (fotg210 == NULL)

		goto err_alloc;

		goto err;



	for (i = 0; i < FOTG210_MAX_NUM_EP; i++) {

		_ep[i] = kzalloc(sizeof(struct fotg210_ep), GFP_KERNEL);
@@ -1114,7 +1117,7 @@ static int fotg210_udc_probe(struct platform_device *pdev) 
	fotg210->reg = ioremap(res->start, resource_size(res));

	if (fotg210->reg == NULL) {

		pr_err("ioremap error.\n");

		goto err_map;

		goto err_alloc;

	}



	spin_lock_init(&fotg210->lock);
@@ -1162,7 +1165,7 @@ static int fotg210_udc_probe(struct platform_device *pdev) 
	fotg210->ep0_req = fotg210_ep_alloc_request(&fotg210->ep[0]->ep,

				GFP_KERNEL);

	if (fotg210->ep0_req == NULL)

		goto err_req;

		goto err_map;



	fotg210_init(fotg210);
@@ -1190,12 +1193,14 @@ static int fotg210_udc_probe(struct platform_device *pdev) 
	fotg210_ep_free_request(&fotg210->ep[0]->ep, fotg210->ep0_req);



err_map:

	if (fotg210->reg)

	iounmap(fotg210->reg);



err_alloc:

	for (i = 0; i < FOTG210_MAX_NUM_EP; i++)

		kfree(fotg210->ep[i]);

	kfree(fotg210);



err:

	return ret;

}