Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit de2080d4 authored by Al Viro's avatar Al Viro
Browse files

gadget/function/f_fs.c: close leaks 



If ffs_epfile_io() fails in AIO case, we end up leaking io_data
(and iovec_copy in case of AIO read).

Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
parent d879cb83

drivers/usb/gadget/function/f_fs.c

+12 −2
Original line number Original line Diff line number Diff line
@@ -970,6 +970,7 @@ static ssize_t ffs_epfile_aio_write(struct kiocb *kiocb, 
				    unsigned long nr_segs, loff_t loff)

				    unsigned long nr_segs, loff_t loff)

{

{

	struct ffs_io_data *io_data;

	struct ffs_io_data *io_data;

	ssize_t res;





	ENTER();

	ENTER();
@@ -989,7 +990,10 @@ static ssize_t ffs_epfile_aio_write(struct kiocb *kiocb, 




	kiocb_set_cancel_fn(kiocb, ffs_aio_cancel);

	kiocb_set_cancel_fn(kiocb, ffs_aio_cancel);





	return ffs_epfile_io(kiocb->ki_filp, io_data);

	res = ffs_epfile_io(kiocb->ki_filp, io_data);

	if (res != -EIOCBQUEUED)

		kfree(io_data);

	return res;

}

}





static ssize_t ffs_epfile_aio_read(struct kiocb *kiocb,

static ssize_t ffs_epfile_aio_read(struct kiocb *kiocb,
@@ -998,6 +1002,7 @@ static ssize_t ffs_epfile_aio_read(struct kiocb *kiocb, 
{

{

	struct ffs_io_data *io_data;

	struct ffs_io_data *io_data;

	struct iovec *iovec_copy;

	struct iovec *iovec_copy;

	ssize_t res;





	ENTER();

	ENTER();
@@ -1025,7 +1030,12 @@ static ssize_t ffs_epfile_aio_read(struct kiocb *kiocb, 




	kiocb_set_cancel_fn(kiocb, ffs_aio_cancel);

	kiocb_set_cancel_fn(kiocb, ffs_aio_cancel);





	return ffs_epfile_io(kiocb->ki_filp, io_data);

	res = ffs_epfile_io(kiocb->ki_filp, io_data);

	if (res != -EIOCBQUEUED) {

		kfree(io_data);

		kfree(iovec_copy);

	}

	return res;

}

}





static int

static int