Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ea8ee240 authored by Oliver Neukum's avatar Oliver Neukum Committed by John W. Linville
Browse files

rtl8187: resource leak in error case 



This fixes resource leaks in error cases due to urb submission
failures.

Signed-off-by: default avatarOliver Neukum <oneukum@suse.de>
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent 89fd2e28

drivers/net/wireless/rtl8187_dev.c

+12 −2
Original line number Original line Diff line number Diff line
@@ -92,6 +92,7 @@ static void rtl8187_iowrite_async(struct rtl8187_priv *priv, __le16 addr, 
		u8 data[4];

		u8 data[4];

		struct usb_ctrlrequest dr;

		struct usb_ctrlrequest dr;

	} *buf;

	} *buf;

	int rc;





	buf = kmalloc(sizeof(*buf), GFP_ATOMIC);

	buf = kmalloc(sizeof(*buf), GFP_ATOMIC);

	if (!buf)

	if (!buf)
@@ -116,7 +117,11 @@ static void rtl8187_iowrite_async(struct rtl8187_priv *priv, __le16 addr, 
	usb_fill_control_urb(urb, priv->udev, usb_sndctrlpipe(priv->udev, 0),

	usb_fill_control_urb(urb, priv->udev, usb_sndctrlpipe(priv->udev, 0),

			     (unsigned char *)dr, buf, len,

			     (unsigned char *)dr, buf, len,

			     rtl8187_iowrite_async_cb, buf);

			     rtl8187_iowrite_async_cb, buf);

	usb_submit_urb(urb, GFP_ATOMIC);

	rc = usb_submit_urb(urb, GFP_ATOMIC);

	if (rc < 0) {

		kfree(buf);

		usb_free_urb(urb);

	}

}

}





static inline void rtl818x_iowrite32_async(struct rtl8187_priv *priv,

static inline void rtl818x_iowrite32_async(struct rtl8187_priv *priv,
@@ -169,6 +174,7 @@ static int rtl8187_tx(struct ieee80211_hw *dev, struct sk_buff *skb, 
	struct urb *urb;

	struct urb *urb;

	__le16 rts_dur = 0;

	__le16 rts_dur = 0;

	u32 flags;

	u32 flags;

	int rc;





	urb = usb_alloc_urb(0, GFP_ATOMIC);

	urb = usb_alloc_urb(0, GFP_ATOMIC);

	if (!urb) {

	if (!urb) {
@@ -208,7 +214,11 @@ static int rtl8187_tx(struct ieee80211_hw *dev, struct sk_buff *skb, 
	info->dev = dev;

	info->dev = dev;

	usb_fill_bulk_urb(urb, priv->udev, usb_sndbulkpipe(priv->udev, 2),

	usb_fill_bulk_urb(urb, priv->udev, usb_sndbulkpipe(priv->udev, 2),

			  hdr, skb->len, rtl8187_tx_cb, skb);

			  hdr, skb->len, rtl8187_tx_cb, skb);

	usb_submit_urb(urb, GFP_ATOMIC);

	rc = usb_submit_urb(urb, GFP_ATOMIC);

	if (rc < 0) {

		usb_free_urb(urb);

		kfree_skb(skb);

	}





	return 0;

	return 0;

}

}