diff mbox series

usb: serial: io_edgeport: fix memory leak in edge_startup

Message ID 20210301230152.527093-1-paskripkin@gmail.com (mailing list archive)
State Accepted
Commit cfdc67acc785e01a8719eeb7012709d245564701
Headers show
Series usb: serial: io_edgeport: fix memory leak in edge_startup | expand

Commit Message

Pavel Skripkin March 1, 2021, 11:01 p.m. UTC 
sysbot found memory leak in edge_startup().
The problem was that when an error was received from the usb_submit_urb(),
nothing was cleaned up.

Reported-by: syzbot+59f777bdcbdd7eea5305@syzkaller.appspotmail.com
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
---
 drivers/usb/serial/io_edgeport.c | 26 ++++++++++++++++----------
 1 file changed, 16 insertions(+), 10 deletions(-)

Comments

Johan Hovold March 5, 2021, 9:53 a.m. UTC | #1 
On Tue, Mar 02, 2021 at 02:01:52AM +0300, Pavel Skripkin wrote:
> sysbot found memory leak in edge_startup().
> The problem was that when an error was received from the usb_submit_urb(),
> nothing was cleaned up.
> 
> Reported-by: syzbot+59f777bdcbdd7eea5305@syzkaller.appspotmail.com
> Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>

Now applied, thanks.

Johan
diff mbox series

Patch

diff --git a/drivers/usb/serial/io_edgeport.c b/drivers/usb/serial/io_edgeport.c
index a493670c06e6..68401adcffde 100644
--- a/drivers/usb/serial/io_edgeport.c
+++ b/drivers/usb/serial/io_edgeport.c
@@ -3003,26 +3003,32 @@  static int edge_startup(struct usb_serial *serial)
 				response = -ENODEV;
 			}
 
-			usb_free_urb(edge_serial->interrupt_read_urb);
-			kfree(edge_serial->interrupt_in_buffer);
-
-			usb_free_urb(edge_serial->read_urb);
-			kfree(edge_serial->bulk_in_buffer);
-
-			kfree(edge_serial);
-
-			return response;
+			goto error;
 		}
 
 		/* start interrupt read for this edgeport this interrupt will
 		 * continue as long as the edgeport is connected */
 		response = usb_submit_urb(edge_serial->interrupt_read_urb,
 								GFP_KERNEL);
-		if (response)
+		if (response) {
 			dev_err(ddev, "%s - Error %d submitting control urb\n",
 				__func__, response);
+
+			goto error;
+		}
 	}
 	return response;
+
+error:
+	usb_free_urb(edge_serial->interrupt_read_urb);
+	kfree(edge_serial->interrupt_in_buffer);
+
+	usb_free_urb(edge_serial->read_urb);
+	kfree(edge_serial->bulk_in_buffer);
+
+	kfree(edge_serial);
+
+	return response;
 }