dect
/
linux-2.6
Archived
13
0
Fork 0
Code Releases Activity

USB: fix memleak in usbfs 

This patch fixes a memory leak in devio.c::processcompl

If writing to user space fails the packet must be discarded, as it
already has been removed from the queue of completed packets.

Signed-off-by: Oliver Neukum <oliver@neukum.org>
Cc: stable <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This commit is contained in:
Oliver Neukum 2009-06-28 23:34:14 +02:00 committed by Greg Kroah-Hartman
parent ba516de332
commit d794a02111
1 changed files with 10 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
drivers/usb/core/devio.c
View File

@ -1231,22 +1231,22 @@ static int processcompl(struct async *as, void __user * __user *arg)
if (as->userbuffer)
if (copy_to_user(as->userbuffer, urb->transfer_buffer,
urb->transfer_buffer_length))
return -EFAULT;
goto err_out;
if (put_user(as->status, &userurb->status))
return -EFAULT;
goto err_out;
if (put_user(urb->actual_length, &userurb->actual_length))
return -EFAULT;
goto err_out;
if (put_user(urb->error_count, &userurb->error_count))
return -EFAULT;
goto err_out;
if (usb_endpoint_xfer_isoc(&urb->ep->desc)) {
for (i = 0; i < urb->number_of_packets; i++) {
if (put_user(urb->iso_frame_desc[i].actual_length,
&userurb->iso_frame_desc[i].actual_length))
return -EFAULT;
goto err_out;
if (put_user(urb->iso_frame_desc[i].status,
&userurb->iso_frame_desc[i].status))
return -EFAULT;
goto err_out;
}
}
@ -1255,6 +1255,10 @@ static int processcompl(struct async *as, void __user * __user *arg)
if (put_user(addr, (void __user * __user *)arg))
return -EFAULT;
return 0;
err_out:
free_async(as);
return -EFAULT;
}
static struct async *reap_as(struct dev_state *ps)