Return-Path: From: Sasha Levin To: "stable@vger.kernel.org" , "linux-kernel@vger.kernel.org" CC: Anton Vasilyev , Felipe Balbi , Sasha Levin Subject: [PATCH AUTOSEL 3.18 01/13] usb: gadget: fotg210-udc: Fix memory leak of fotg210->ep[i] Date: Mon, 1 Oct 2018 00:41:44 +0000 Message-ID: <20181001004139.147341-1-alexander.levin@microsoft.com> Content-Language: en-US Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Sender: linux-kernel-owner@vger.kernel.org List-ID: From: Anton Vasilyev [ Upstream commit c37bd52836296ecc9a0fc8060b819089aebdbcde ] There is no deallocation of fotg210->ep[i] elements, allocated at fotg210_udc_probe. The patch adds deallocation of fotg210->ep array elements and simplifies error path of fotg210_udc_probe(). Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Anton Vasilyev Signed-off-by: Felipe Balbi Signed-off-by: Sasha Levin --- drivers/usb/gadget/udc/fotg210-udc.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/drivers/usb/gadget/udc/fotg210-udc.c b/drivers/usb/gadget/udc/= fotg210-udc.c index 1d315921bf34..9500e2b6cd59 100644 --- a/drivers/usb/gadget/udc/fotg210-udc.c +++ b/drivers/usb/gadget/udc/fotg210-udc.c @@ -1077,12 +1077,15 @@ static struct usb_gadget_ops fotg210_gadget_ops =3D= { static int fotg210_udc_remove(struct platform_device *pdev) { struct fotg210_udc *fotg210 =3D platform_get_drvdata(pdev); + int i; =20 usb_del_gadget_udc(&fotg210->gadget); iounmap(fotg210->reg); free_irq(platform_get_irq(pdev, 0), fotg210); =20 fotg210_ep_free_request(&fotg210->ep[0]->ep, fotg210->ep0_req); + for (i =3D 0; i < FOTG210_MAX_NUM_EP; i++) + kfree(fotg210->ep[i]); kfree(fotg210); =20 return 0; @@ -1113,7 +1116,7 @@ static int fotg210_udc_probe(struct platform_device *= pdev) /* initialize udc */ fotg210 =3D kzalloc(sizeof(struct fotg210_udc), GFP_KERNEL); if (fotg210 =3D=3D NULL) - goto err_alloc; + goto err; =20 for (i =3D 0; i < FOTG210_MAX_NUM_EP; i++) { _ep[i] =3D kzalloc(sizeof(struct fotg210_ep), GFP_KERNEL); @@ -1125,7 +1128,7 @@ static int fotg210_udc_probe(struct platform_device *= pdev) fotg210->reg =3D ioremap(res->start, resource_size(res)); if (fotg210->reg =3D=3D NULL) { pr_err("ioremap error.\n"); - goto err_map; + goto err_alloc; } =20 spin_lock_init(&fotg210->lock); @@ -1162,7 +1165,7 @@ static int fotg210_udc_probe(struct platform_device *= pdev) fotg210->ep0_req =3D fotg210_ep_alloc_request(&fotg210->ep[0]->ep, GFP_KERNEL); if (fotg210->ep0_req =3D=3D NULL) - goto err_req; + goto err_map; =20 fotg210_init(fotg210); =20 @@ -1191,12 +1194,14 @@ static int fotg210_udc_probe(struct platform_device= *pdev) fotg210_ep_free_request(&fotg210->ep[0]->ep, fotg210->ep0_req); =20 err_map: - if (fotg210->reg) - iounmap(fotg210->reg); + iounmap(fotg210->reg); =20 err_alloc: + for (i =3D 0; i < FOTG210_MAX_NUM_EP; i++) + kfree(fotg210->ep[i]); kfree(fotg210); =20 +err: return ret; } =20 --=20 2.17.1