Skip to contentSkip to conversation

mceusb: fix memory leaks in error path

PATCH New Johan Hovold 1 participant 2 messages Jun 1, 2017

Subsystems (3)
Stable branch Media (V4L/DVB) RC-core / lirc framework
lore
Share & tools
lore

Johan Hovold

author
#0 lore raw

PATCH 1/2 mceusb: fix memory leaks in error path

Fix urb and transfer-buffer leaks in an urb-submission error path which may be hit when a device is disconnected.

Fixes 66e89522aff7 ("V4L/DVB: IR: add mceusb IR receiver driver")
Cc stable <[email protected]> # 2.6.36
Cc Jarod Wilson <[email protected]>
Signed-off-by Johan Hovold <[email protected]>
---
 drivers/media/rc/mceusb.c | 2 ++
 1 file changed, 2 insertions(+)
drivers/media/rc/mceusb.c +2 -0
index 93b16fe3ab38..0a16bd34ee4e 100644
@@ -766,6 +766,8 @@ static void mce_request_packet(struct mceusb_dev *ir, unsigned char *data,
 	res = usb_submit_urb(async_urb, GFP_ATOMIC);
 	if (res) {
 		dev_err(dev, "receive request FAILED! (res=%d)", res);
+		kfree(async_buf);
+		usb_free_urb(async_urb);
 		return;
 	}
 	dev_dbg(dev, "receive request complete (res=%d)", res);
Signature · 1 line
2.13.0
author
#1 lore raw

PATCH 2/2 mceusb: drop redundant urb reinitialisation

Drop a since commit e1159cb35712 ("[media] mceusb: remove pointless mce_flush_rx_buffer function") redundant reinitialisation of two urb fields immediately after they have been initialised.

Signed-off-by Johan Hovold <[email protected]>
---
 drivers/media/rc/mceusb.c | 3 ---
 1 file changed, 3 deletions(-)
drivers/media/rc/mceusb.c +0 -3
index 0a16bd34ee4e..cba7ae90c000 100644
@@ -760,9 +760,6 @@ static void mce_request_packet(struct mceusb_dev *ir, unsigned char *data,
 
 	dev_dbg(dev, "receive request called (size=%#x)", size);
 
-	async_urb->transfer_buffer_length = size;
-	async_urb->dev = ir->usbdev;
-
 	res = usb_submit_urb(async_urb, GFP_ATOMIC);
 	if (res) {
 		dev_err(dev, "receive request FAILED! (res=%d)", res);
Signature · 1 line
2.13.0