[ldv-project] [PATCH] can: pcan_usb_core: fix memory leak on failure paths in peak_usb_start()

[Marc Kleine-Budde]

Added Stephane to Cc.

On 09/04/2013 11:46 PM, Alexey Khoroshilov wrote:
> Tx and rx urbs are not deallocated if something goes wrong in peak_usb_start().
> The patch fixes error handling to deallocate all the resources.
> 
> Found by Linux Driver Verification project (linuxtesting.org).
> 
> Signed-off-by: Alexey Khoroshilov <khoroshilov at ispras.ru>

Stephane, can you have a look at the patch and give your Acked-by.

Looks good to me.

tnx,
Marc
> ---
>  drivers/net/can/usb/peak_usb/pcan_usb_core.c | 15 +++++++++++----
>  1 file changed, 11 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_core.c b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
> index a0f647f..0b7a4c3 100644
> --- a/drivers/net/can/usb/peak_usb/pcan_usb_core.c
> +++ b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
> @@ -463,7 +463,7 @@ static int peak_usb_start(struct peak_usb_device *dev)
>  	if (i < PCAN_USB_MAX_TX_URBS) {
>  		if (i == 0) {
>  			netdev_err(netdev, "couldn't setup any tx URB\n");
> -			return err;
> +			goto err_tx;
>  		}
>  
>  		netdev_warn(netdev, "tx performance may be slow\n");
> @@ -472,7 +472,7 @@ static int peak_usb_start(struct peak_usb_device *dev)
>  	if (dev->adapter->dev_start) {
>  		err = dev->adapter->dev_start(dev);
>  		if (err)
> -			goto failed;
> +			goto err_adapter;
>  	}
>  
>  	dev->state |= PCAN_USB_STATE_STARTED;
> @@ -481,19 +481,26 @@ static int peak_usb_start(struct peak_usb_device *dev)
>  	if (dev->adapter->dev_set_bus) {
>  		err = dev->adapter->dev_set_bus(dev, 1);
>  		if (err)
> -			goto failed;
> +			goto err_adapter;
>  	}
>  
>  	dev->can.state = CAN_STATE_ERROR_ACTIVE;
>  
>  	return 0;
>  
> -failed:
> +err_adapter:
>  	if (err == -ENODEV)
>  		netif_device_detach(dev->netdev);
>  
>  	netdev_warn(netdev, "couldn't submit control: %d\n", err);
>  
> +	for (i = 0; i < PCAN_USB_MAX_TX_URBS; i++) {
> +		usb_free_urb(dev->tx_contexts[i].urb);
> +		dev->tx_contexts[i].urb = NULL;
> +	}
> +err_tx:
> +	usb_kill_anchored_urbs(&dev->rx_submitted);
> +
>  	return err;
>  }
>  
> 


-- 
Pengutronix e.K.                  | Marc Kleine-Budde           |
Industrial Linux Solutions        | Phone: +49-231-2826-924     |
Vertretung West/Dortmund          | Fax:   +49-5121-206917-5555 |
Amtsgericht Hildesheim, HRA 2686  | http://www.pengutronix.de   |

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 259 bytes
Desc: OpenPGP digital signature
URL: <http://linuxtesting.org/pipermail/ldv-project/attachments/20130905/5cb64805/attachment.pgp>