linux-kernel - [2.6 patch] drivers/bluetooth/bpa10x.c: fix memleak

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20071024162632.GL30533@stusta.de>
Date:	Wed, 24 Oct 2007 18:26:32 +0200
From:	Adrian Bunk <bunk@...nel.org>
To:	Marcel Holtmann <marcel@...tmann.org>, maxk@...lcomm.com
Cc:	bluez-devel@...ts.sf.net, linux-kernel@...r.kernel.org
Subject: [2.6 patch] drivers/bluetooth/bpa10x.c: fix memleak

This patch fixea a memleak spotted by the Coverity checker.

Signed-off-by: Adrian Bunk <bunk@...nel.org>

---

 drivers/bluetooth/bpa10x.c |    1 +
 1 file changed, 1 insertion(+)

--- linux-2.6/drivers/bluetooth/bpa10x.c.old	2007-10-23 22:20:10.000000000 +0200
+++ linux-2.6/drivers/bluetooth/bpa10x.c	2007-10-23 22:22:01.000000000 +0200
@@ -378,96 +378,97 @@ static int bpa10x_send_frame(struct sk_b
 	urb = usb_alloc_urb(0, GFP_ATOMIC);
 	if (!urb)
 		return -ENOMEM;
 
 	/* Prepend skb with frame type */
 	*skb_push(skb, 1) = bt_cb(skb)->pkt_type;
 
 	switch (bt_cb(skb)->pkt_type) {
 	case HCI_COMMAND_PKT:
 		dr = kmalloc(sizeof(*dr), GFP_ATOMIC);
 		if (!dr) {
 			usb_free_urb(urb);
 			return -ENOMEM;
 		}
 
 		dr->bRequestType = USB_TYPE_VENDOR;
 		dr->bRequest     = 0;
 		dr->wIndex       = 0;
 		dr->wValue       = 0;
 		dr->wLength      = __cpu_to_le16(skb->len);
 
 		pipe = usb_sndctrlpipe(data->udev, 0x00);
 
 		usb_fill_control_urb(urb, data->udev, pipe, (void *) dr,
 				skb->data, skb->len, bpa10x_tx_complete, skb);
 
 		hdev->stat.cmd_tx++;
 		break;
 
 	case HCI_ACLDATA_PKT:
 		pipe = usb_sndbulkpipe(data->udev, 0x02);
 
 		usb_fill_bulk_urb(urb, data->udev, pipe,
 				skb->data, skb->len, bpa10x_tx_complete, skb);
 
 		hdev->stat.acl_tx++;
 		break;
 
 	case HCI_SCODATA_PKT:
 		pipe = usb_sndbulkpipe(data->udev, 0x02);
 
 		usb_fill_bulk_urb(urb, data->udev, pipe,
 				skb->data, skb->len, bpa10x_tx_complete, skb);
 
 		hdev->stat.sco_tx++;
 		break;
 
 	default:
+		usb_free_urb(urb);
 		return -EILSEQ;
 	}
 
 	usb_anchor_urb(urb, &data->tx_anchor);
 
 	err = usb_submit_urb(urb, GFP_ATOMIC);
 	if (err < 0) {
 		BT_ERR("%s urb %p submission failed", hdev->name, urb);
 		kfree(urb->setup_packet);
 		usb_unanchor_urb(urb);
 	}
 
 	usb_free_urb(urb);
 
 	return 0;
 }
 
 static void bpa10x_destruct(struct hci_dev *hdev)
 {
 	struct bpa10x_data *data = hdev->driver_data;
 
 	BT_DBG("%s", hdev->name);
 
 	kfree(data->rx_skb[0]);
 	kfree(data->rx_skb[1]);
 	kfree(data);
 }
 
 static int bpa10x_probe(struct usb_interface *intf, const struct usb_device_id *id)
 {
 	struct bpa10x_data *data;
 	struct hci_dev *hdev;
 	int err;
 
 	BT_DBG("intf %p id %p", intf, id);
 
 	if (ignore)
 		return -ENODEV;
 
 	if (intf->cur_altsetting->desc.bInterfaceNumber != 0)
 		return -ENODEV;
 
 	data = kzalloc(sizeof(*data), GFP_KERNEL);
 	if (!data)
 		return -ENOMEM;
 
 	data->udev = interface_to_usbdev(intf);
 

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/