Commit cfdc67ac authored by Pavel Skripkin's avatar Pavel Skripkin Committed by Johan Hovold
Browse files

USB: serial: io_edgeport: fix memory leak in edge_startup 



sysbot found memory leak in edge_startup().
The problem was that when an error was received from the usb_submit_urb(),
nothing was cleaned up.

Reported-by: default avatar <syzbot+59f777bdcbdd7eea5305@syzkaller.appspotmail.com>
Signed-off-by: default avatarPavel Skripkin <paskripkin@gmail.com>
Fixes: 6e8cf775 ("USB: add EPIC support to the io_edgeport driver")
Cc: stable@vger.kernel.org	# 2.6.21: c5c0c555
Signed-off-by: default avatarJohan Hovold <johan@kernel.org>
parent 5563b3b6

drivers/usb/serial/io_edgeport.c

+16 −10
Original line number Diff line number Diff line
@@ -3003,25 +3003,31 @@ static int edge_startup(struct usb_serial *serial) 
				response = -ENODEV;

			}



			usb_free_urb(edge_serial->interrupt_read_urb);

			kfree(edge_serial->interrupt_in_buffer);



			usb_free_urb(edge_serial->read_urb);

			kfree(edge_serial->bulk_in_buffer);



			kfree(edge_serial);



			return response;

			goto error;

		}



		/* start interrupt read for this edgeport this interrupt will

		 * continue as long as the edgeport is connected */

		response = usb_submit_urb(edge_serial->interrupt_read_urb,

								GFP_KERNEL);

		if (response)

		if (response) {

			dev_err(ddev, "%s - Error %d submitting control urb\n",

				__func__, response);



			goto error;

		}

	}

	return response;



error:

	usb_free_urb(edge_serial->interrupt_read_urb);

	kfree(edge_serial->interrupt_in_buffer);



	usb_free_urb(edge_serial->read_urb);

	kfree(edge_serial->bulk_in_buffer);



	kfree(edge_serial);



	return response;

}