Skip to contentSkip to conversation

USB: serial: kl5kusb105: fix memleak on open

PATCH In review Johan Hovold 2 participants 3 messages Dec 4, 2020

Subsystems (3)
lore
Share & tools
lore

Johan Hovold

author maintainer
#0 lore raw

PATCH 1/1 USB: serial: kl5kusb105: fix memleak on open

Fix memory leak of control-message transfer buffer on successful open().

Fixes 6774d5f53271 ("USB: serial: kl5kusb105: fix open error path")

---

While reviewing Himadri's control-message series I noticed we have a related bug in klsi_105_open() that needs fixing.

 drivers/usb/serial/kl5kusb105.c | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)
drivers/usb/serial/kl5kusb105.c +4 -6
index 5ee48b0650c4..5f6b82ebccc5 100644
@@ -276,12 +276,12 @@ static int  klsi_105_open(struct tty_struct *tty, struct usb_serial_port *port)
 	priv->cfg.unknown2 = cfg->unknown2;
 	spin_unlock_irqrestore(&priv->lock, flags);
 
+	kfree(cfg);
+
 	/* READ_ON and urb submission */
 	rc = usb_serial_generic_open(tty, port);
-	if (rc) {
-		retval = rc;
-		goto err_free_cfg;
-	}
+	if (rc)
+		return rc;
 
 	rc = usb_control_msg(port->serial->dev,
 			     usb_sndctrlpipe(port->serial->dev, 0),
@@ -324,8 +324,6 @@ static int  klsi_105_open(struct tty_struct *tty, struct usb_serial_port *port)
 			     KLSI_TIMEOUT);
 err_generic_close:
 	usb_serial_generic_close(port);
-err_free_cfg:
-	kfree(cfg);
 
 	return retval;
 }
Signature · 1 line
2.26.2
author maintainer
#1 lore raw
Quoted 36 lines · Johan Hovold

Fix memory leak of control-message transfer buffer on successful open().

Fixes 6774d5f53271 ("USB: serial: kl5kusb105: fix open error path")

---

While reviewing Himadri's control-message series I noticed we have a related bug in klsi_105_open() that needs fixing.

 drivers/usb/serial/kl5kusb105.c | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)
drivers/usb/serial/kl5kusb105.c +4 -4
index 5ee48b0650c4..5f6b82ebccc5 100644
@@ -276,12 +276,12 @@ static int  klsi_105_open(struct tty_struct *tty, struct usb_serial_port *port)
 	priv->cfg.unknown2 = cfg->unknown2;
 	spin_unlock_irqrestore(&priv->lock, flags);
 
+	kfree(cfg);
+
 	/* READ_ON and urb submission */
 	rc = usb_serial_generic_open(tty, port);
-	if (rc) {
-		retval = rc;
-		goto err_free_cfg;
-	}
+	if (rc)
+		return rc;
 
 	rc = usb_control_msg(port->serial->dev,
 			     usb_sndctrlpipe(port->serial->dev, 0),

drivers/usb/serial/kl5kusb105.c static int klsi_105_open(struct tty_struct *tty, struct usb_serial_port *port) · line 329

Quoted 8 lines
drivers/usb/serial/kl5kusb105.c +0 -2
@@ -324,8 +324,6 @@ static int  klsi_105_open(struct tty_struct *tty, struct usb_serial_port *port)
 			     KLSI_TIMEOUT);
 err_generic_close:
 	usb_serial_generic_close(port);
-err_free_cfg:
-	kfree(cfg);
 
 	return retval;
 }

I've applied this one now so that I can include it in my pull-request for -rc7.

Greg, just let me know if you think I should hold this one off for 5.11 instead.

Johan

#2 lore raw
Quoted 43 lines · Johan Hovold
Quoted 42 lines · Johan Hovold

Fix memory leak of control-message transfer buffer on successful open().

Fixes 6774d5f53271 ("USB: serial: kl5kusb105: fix open error path")

---

While reviewing Himadri's control-message series I noticed we have a related bug in klsi_105_open() that needs fixing.

 drivers/usb/serial/kl5kusb105.c | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)
drivers/usb/serial/kl5kusb105.c +4 -6
index 5ee48b0650c4..5f6b82ebccc5 100644
@@ -276,12 +276,12 @@ static int  klsi_105_open(struct tty_struct *tty, struct usb_serial_port *port)
 	priv->cfg.unknown2 = cfg->unknown2;
 	spin_unlock_irqrestore(&priv->lock, flags);
 
+	kfree(cfg);
+
 	/* READ_ON and urb submission */
 	rc = usb_serial_generic_open(tty, port);
-	if (rc) {
-		retval = rc;
-		goto err_free_cfg;
-	}
+	if (rc)
+		return rc;
 
 	rc = usb_control_msg(port->serial->dev,
 			     usb_sndctrlpipe(port->serial->dev, 0),
@@ -324,8 +324,6 @@ static int  klsi_105_open(struct tty_struct *tty, struct usb_serial_port *port)
 			     KLSI_TIMEOUT);
 err_generic_close:
 	usb_serial_generic_close(port);
-err_free_cfg:
-	kfree(cfg);
 
Quoted 8 lines

drivers/usb/serial/kl5kusb105.c static int klsi_105_open(struct tty_struct *tty, struct usb_serial_port *port) · line 329

Quoted 2 lines
drivers/usb/serial/kl5kusb105.c +0 -0
 	return retval;
 }

I've applied this one now so that I can include it in my pull-request for -rc7.

Greg, just let me know if you think I should hold this one off for 5.11 instead.

Nope, it's fine to take this now, thanks.

greg k-h