Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 79731cbd authored by Thomas Pugliese's avatar Thomas Pugliese Committed by Greg Kroah-Hartman
Browse files

USB: WUSBCORE: fix leak of urb in wa_xfer_destroy. 



The check to free the URB was the opposite of the correct case.  This
patch removes the check altogether since the ptr will be NULL if the URB
was not allocated.  Also use usb_free_urb instead of usb_put_urb.

Signed-off-by: default avatarThomas Pugliese <thomas.pugliese@gmail.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 11b1bf81

drivers/usb/wusbcore/wa-xfer.c

+4 −5
Original line number Diff line number Diff line
@@ -166,8 +166,8 @@ static inline void wa_xfer_init(struct wa_xfer *xfer) 
/*

 * Destroy a transfer structure

 *

 * Note that the xfer->seg[index] thingies follow the URB life cycle,

 * so we need to put them, not free them.

 * Note that freeing xfer->seg[cnt]->urb will free the containing

 * xfer->seg[cnt] memory that was allocated by __wa_xfer_setup_segs.

 */

static void wa_xfer_destroy(struct kref *_xfer)

{
@@ -175,9 +175,8 @@ static void wa_xfer_destroy(struct kref *_xfer) 
	if (xfer->seg) {

		unsigned cnt;

		for (cnt = 0; cnt < xfer->segs; cnt++) {

			if (xfer->is_inbound)

				usb_put_urb(xfer->seg[cnt]->dto_urb);

			usb_put_urb(&xfer->seg[cnt]->urb);

			usb_free_urb(xfer->seg[cnt]->dto_urb);

			usb_free_urb(&xfer->seg[cnt]->urb);

		}

	}

	kfree(xfer);