linux-kernel - Re: [PATCH 4.19 22/90] usb: gadget: fusb300_udc: Fix memory leak of fusb300->ep[i]

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 9 Jul 2019 10:13:04 +0200
From:   Pavel Machek <pavel@....cz>
To:     pavel@....cz
Cc:     linux-kernel@...r.kernel.org, Young Xiao <92siuyang@...il.com>,
        Felipe Balbi <felipe.balbi@...ux.intel.com>,
        Sasha Levin <sashal@...nel.org>
Subject: Re: [PATCH 4.19 22/90] usb: gadget: fusb300_udc: Fix memory leak of
 fusb300->ep[i]

Hi!

> There is no deallocation of fusb300->ep[i] elements, allocated at
> fusb300_probe.
> 
> The patch adds deallocation of fusb300->ep array elements.
... 
> diff --git a/drivers/usb/gadget/udc/fusb300_udc.c b/drivers/usb/gadget/udc/fusb300_udc.c
> index 263804d154a7..00e3f66836a9 100644
> --- a/drivers/usb/gadget/udc/fusb300_udc.c
> +++ b/drivers/usb/gadget/udc/fusb300_udc.c
> @@ -1342,12 +1342,15 @@ static const struct usb_gadget_ops fusb300_gadget_ops = {
>  static int fusb300_remove(struct platform_device *pdev)
>  {
>  	struct fusb300 *fusb300 = platform_get_drvdata(pdev);
> +	int i;
>  
>  	usb_del_gadget_udc(&fusb300->gadget);
>  	iounmap(fusb300->reg);
>  	free_irq(platform_get_irq(pdev, 0), fusb300);
>  
>  	fusb300_free_request(&fusb300->ep[0]->ep, fusb300->ep0_req);
> +	for (i = 0; i < FUSB300_MAX_NUM_EP; i++)
> +		kfree(fusb300->ep[i]);
>  	kfree(fusb300);
>  
>  	return 0;
> @@ -1491,6 +1494,8 @@ clean_up:
>  		if (fusb300->ep0_req)
>  			fusb300_free_request(&fusb300->ep[0]->ep,
>  				fusb300->ep0_req);
> +		for (i = 0; i < FUSB300_MAX_NUM_EP; i++)
> +			kfree(fusb300->ep[i]);
>  		kfree(fusb300);
>  	}
>  	if (reg)

Maybe it would be worth it to have a common function doing the cleanup
at this point?

Alternatively consider using devm_ function family; that deallocates
memory automatically.
									Pavel
-- 
(english) http://www.livejournal.com/~pavelmachek
(cesky, pictures) http://atrey.karlin.mff.cuni.cz/~pavel/picture/horses/blog.html

Download attachment "signature.asc" of type "application/pgp-signature" (182 bytes)