Unverified Commit 98d5b044 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!15374 can: gs_usb: gs_usb_open/close(): fix memory leak 

Merge Pull Request from: @ci-robot 
 
PR sync from: Jinjie Ruan <ruanjinjie@huawei.com>
https://mailweb.openeuler.org/archives/list/kernel@openeuler.org/message/56BXFCP6UF3MY2SRXUJIHEK5RADVZK6S/ 
 
https://gitee.com/src-openeuler/kernel/issues/IBP6SC 
 
Link:https://gitee.com/openeuler/kernel/pulls/15374

 

Reviewed-by: default avatarYuan Can <yuancan@huawei.com>
Reviewed-by: default avatarZhang Jianhua <chris.zjh@huawei.com>
Reviewed-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
Signed-off-by: default avatarYuan Can <yuancan@huawei.com>
parents 3b7b1989 018fb313

drivers/net/can/usb/gs_usb.c

+21 −2
Original line number Diff line number Diff line
@@ -186,6 +186,8 @@ struct gs_can { 


	struct usb_anchor tx_submitted;

	atomic_t active_tx_urbs;

	void *rxbuf[GS_MAX_RX_URBS];

	dma_addr_t rxbuf_dma[GS_MAX_RX_URBS];

};



/* usb interface struct */
@@ -590,6 +592,7 @@ static int gs_can_open(struct net_device *netdev) 
		for (i = 0; i < GS_MAX_RX_URBS; i++) {

			struct urb *urb;

			u8 *buf;

			dma_addr_t buf_dma;



			/* alloc rx urb */

			urb = usb_alloc_urb(0, GFP_KERNEL);
@@ -600,7 +603,7 @@ static int gs_can_open(struct net_device *netdev) 
			buf = usb_alloc_coherent(dev->udev,

						 sizeof(struct gs_host_frame),

						 GFP_KERNEL,

						 &urb->transfer_dma);

						 &buf_dma);

			if (!buf) {

				netdev_err(netdev,

					   "No memory left for USB buffer\n");
@@ -608,6 +611,8 @@ static int gs_can_open(struct net_device *netdev) 
				return -ENOMEM;

			}



			urb->transfer_dma = buf_dma;



			/* fill, anchor, and submit rx urb */

			usb_fill_bulk_urb(urb,

					  dev->udev,
@@ -631,10 +636,17 @@ static int gs_can_open(struct net_device *netdev) 
					   rc);



				usb_unanchor_urb(urb);

				usb_free_coherent(dev->udev,

						  sizeof(struct gs_host_frame),

						  buf,

						  buf_dma);

				usb_free_urb(urb);

				break;

			}



			dev->rxbuf[i] = buf;

			dev->rxbuf_dma[i] = buf_dma;



			/* Drop reference,

			 * USB core will take care of freeing it

			 */
@@ -698,12 +710,19 @@ static int gs_can_close(struct net_device *netdev) 
	int rc;

	struct gs_can *dev = netdev_priv(netdev);

	struct gs_usb *parent = dev->parent;

	unsigned int i;



	netif_stop_queue(netdev);



	/* Stop polling */

	if (atomic_dec_and_test(&parent->active_channels))

	if (atomic_dec_and_test(&parent->active_channels)) {

		usb_kill_anchored_urbs(&parent->rx_submitted);

		for (i = 0; i < GS_MAX_RX_URBS; i++)

			usb_free_coherent(dev->udev,

					  sizeof(struct gs_host_frame),

					  dev->rxbuf[i],

					  dev->rxbuf_dma[i]);

	}



	/* Stop sending URBs */

	usb_kill_anchored_urbs(&dev->tx_submitted);