Commit 7e2d2f24 authored by Jianglei Nie's avatar Jianglei Nie Committed by Jialin Zhang
Browse files

usb: host: xhci: Fix potential memory leak in xhci_alloc_stream_info() 

stable inclusion
from stable-v5.10.150
commit 91271a3e772e180bbb8afb114c72fd294a02f93d
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I6D0XA

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=91271a3e772e180bbb8afb114c72fd294a02f93d



--------------------------------

[ Upstream commit 7e271f42 ]

xhci_alloc_stream_info() allocates stream context array for stream_info
->stream_ctx_array with xhci_alloc_stream_ctx(). When some error occurs,
stream_info->stream_ctx_array is not released, which will lead to a
memory leak.

We can fix it by releasing the stream_info->stream_ctx_array with
xhci_free_stream_ctx() on the error path to avoid the potential memory
leak.

Signed-off-by: default avatarJianglei Nie <niejianglei2021@163.com>
Signed-off-by: default avatarMathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20220921123450.671459-2-mathias.nyman@linux.intel.com


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
parent e793250b

drivers/usb/host/xhci-mem.c

+6 −1
Original line number Diff line number Diff line
@@ -659,7 +659,7 @@ struct xhci_stream_info *xhci_alloc_stream_info(struct xhci_hcd *xhci, 
			num_stream_ctxs, &stream_info->ctx_array_dma,

			mem_flags);

	if (!stream_info->stream_ctx_array)

		goto cleanup_ctx;

		goto cleanup_ring_array;

	memset(stream_info->stream_ctx_array, 0,

			sizeof(struct xhci_stream_ctx)*num_stream_ctxs);
@@ -720,6 +720,11 @@ struct xhci_stream_info *xhci_alloc_stream_info(struct xhci_hcd *xhci, 
	}

	xhci_free_command(xhci, stream_info->free_streams_command);

cleanup_ctx:

	xhci_free_stream_ctx(xhci,

		stream_info->num_stream_ctxs,

		stream_info->stream_ctx_array,

		stream_info->ctx_array_dma);

cleanup_ring_array:

	kfree(stream_info->stream_rings);

cleanup_info:

	kfree(stream_info);