adulau/aha
1
0
Fork 0
mirror of https://github.com/adulau/aha.git synced 2025-01-01 13:46:24 +00:00
Code Issues Projects Releases Packages Wiki Activity

USB: fix memleak in usbfs

Browse source 
This patch fixes a memory leak in devio.c::processcompl

If writing to user space fails the packet must be discarded, as it
already has been removed from the queue of completed packets.

Signed-off-by: Oliver Neukum <oliver@neukum.org>
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This commit is contained in:
Oliver Neukum 2009-06-28 23:34:14 +02:00 committed by Greg Kroah-Hartman
parent ba516de332
commit d794a02111
1 changed files with 10 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
drivers/usb/core/devio.c
View file

@ -1231,22 +1231,22 @@ static int processcompl(struct async *as, void __user * __user *arg)
if (as->userbuffer) if (as->userbuffer)
if (copy_to_user(as->userbuffer, urb->transfer_buffer, if (copy_to_user(as->userbuffer, urb->transfer_buffer,
urb->transfer_buffer_length)) urb->transfer_buffer_length))
return -EFAULT; goto err_out;
if (put_user(as->status, &userurb->status)) if (put_user(as->status, &userurb->status))
return -EFAULT; goto err_out;
if (put_user(urb->actual_length, &userurb->actual_length)) if (put_user(urb->actual_length, &userurb->actual_length))
return -EFAULT; goto err_out;
if (put_user(urb->error_count, &userurb->error_count)) if (put_user(urb->error_count, &userurb->error_count))
return -EFAULT; goto err_out;
if (usb_endpoint_xfer_isoc(&urb->ep->desc)) { if (usb_endpoint_xfer_isoc(&urb->ep->desc)) {
for (i = 0; i < urb->number_of_packets; i++) { for (i = 0; i < urb->number_of_packets; i++) {
if (put_user(urb->iso_frame_desc[i].actual_length, if (put_user(urb->iso_frame_desc[i].actual_length,
&userurb->iso_frame_desc[i].actual_length)) &userurb->iso_frame_desc[i].actual_length))
return -EFAULT; goto err_out;
if (put_user(urb->iso_frame_desc[i].status, if (put_user(urb->iso_frame_desc[i].status,
&userurb->iso_frame_desc[i].status)) &userurb->iso_frame_desc[i].status))
return -EFAULT; goto err_out;
} }
} }
@ -1255,6 +1255,10 @@ static int processcompl(struct async *as, void __user * __user *arg)
if (put_user(addr, (void __user * __user *)arg)) if (put_user(addr, (void __user * __user *)arg))
return -EFAULT; return -EFAULT;
return 0; return 0;
err_out:
free_async(as);
return -EFAULT;
} }
static struct async *reap_as(struct dev_state *ps) static struct async *reap_as(struct dev_state *ps)