[PATCH] qcserial: fix a memory leak in qcprobe error path

[PATCH] qcserial: fix a memory leak in qcprobe error path

[Axel Lin]

In current implemtation, the "data" is not kfreed in qcprobe error path.
This patch moves the memory allocation a little bit latter and only
allocate memory when no error is detected in previous checking.

Signed-off-by: Axel Lin <axel.lin@gmail.com>
---
 drivers/usb/serial/qcserial.c |   30 +++++++++++++++++-------------
 1 files changed, 17 insertions(+), 13 deletions(-)

diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
index 04bb759..d30078c 100644
--- a/drivers/usb/serial/qcserial.c
+++ b/drivers/usb/serial/qcserial.c
@@ -109,13 +109,6 @@ static int qcprobe(struct usb_serial *serial, const struct usb_device_id *id)
 	ifnum = intf->desc.bInterfaceNumber;
 	dbg("This Interface = %d", ifnum);
 
-	data = serial->private = kzalloc(sizeof(struct usb_wwan_intf_private),
-					 GFP_KERNEL);
-	if (!data)
-		return -ENOMEM;
-
-	spin_lock_init(&data->susp_lock);
-
 	switch (nintf) {
 	case 1:
 		/* QDL mode */
@@ -130,8 +123,10 @@ static int qcprobe(struct usb_serial *serial, const struct usb_device_id *id)
 		    usb_endpoint_is_bulk_out(&intf->endpoint[1].desc)) {
 			dbg("QDL port found");
 
-			if (serial->interface->num_altsetting == 1)
-				return 0;
+			if (serial->interface->num_altsetting == 1) {
+				retval = 0;
+				goto out;
+			}
 
 			retval = usb_set_interface(serial->dev, ifnum, 1);
 			if (retval < 0) {
@@ -140,7 +135,7 @@ static int qcprobe(struct usb_serial *serial, const struct usb_device_id *id)
 					retval);
 				retval = -ENODEV;
 			}
-			return retval;
+			goto out;
 		}
 		break;
 
@@ -156,17 +151,26 @@ static int qcprobe(struct usb_serial *serial, const struct usb_device_id *id)
 					retval);
 				retval = -ENODEV;
 			}
-			return retval;
+			goto out;
 		}
 		break;
 
 	default:
 		dev_err(&serial->dev->dev,
 			"unknown number of interfaces: %d\n", nintf);
-		return -ENODEV;
 	}
 
-	return retval;
+out:
+	if (retval)
+		return retval;
+
+	data = serial->private = kzalloc(sizeof(struct usb_wwan_intf_private),
+					 GFP_KERNEL);
+	if (!data)
+		return -ENOMEM;
+
+	spin_lock_init(&data->susp_lock);
+	return 0;
 }
 
 static struct usb_serial_driver qcdevice = {
-- 
1.5.4.3

Re: [PATCH] qcserial: fix a memory leak in qcprobe error path

[Greg KH]

On Tue, Jun 08, 2010 at 03:29:23PM +0800, Axel Lin wrote:
> In current implemtation, the "data" is not kfreed in qcprobe error path.
> This patch moves the memory allocation a little bit latter and only
> allocate memory when no error is detected in previous checking.

Yeah, but it's now pretty messy.

> --- a/drivers/usb/serial/qcserial.c
> +++ b/drivers/usb/serial/qcserial.c
> @@ -109,13 +109,6 @@ static int qcprobe(struct usb_serial *serial, const struct usb_device_id *id)
>  	ifnum = intf->desc.bInterfaceNumber;
>  	dbg("This Interface = %d", ifnum);
>  
> -	data = serial->private = kzalloc(sizeof(struct usb_wwan_intf_private),
> -					 GFP_KERNEL);
> -	if (!data)
> -		return -ENOMEM;
> -
> -	spin_lock_init(&data->susp_lock);
> -

Moving this to the end is fine.

> @@ -140,7 +135,7 @@ static int qcprobe(struct usb_serial *serial, const struct usb_device_id *id)
>  					retval);
>  				retval = -ENODEV;
>  			}
> -			return retval;
> +			goto out;

But this doesn't need to be changed, right?
Or this.

>  		}
>  		break;
>  
> @@ -156,17 +151,26 @@ static int qcprobe(struct usb_serial *serial, const struct usb_device_id *id)
>  					retval);
>  				retval = -ENODEV;
>  			}
> -			return retval;
> +			goto out;

Or this?

>  		}
>  		break;
>  
>  	default:
>  		dev_err(&serial->dev->dev,
>  			"unknown number of interfaces: %d\n", nintf);
> -		return -ENODEV;

Hm. maybe.

>  	}
>  
> -	return retval;
> +out:
> +	if (retval)
> +		return retval;
> +
> +	data = serial->private = kzalloc(sizeof(struct usb_wwan_intf_private),
> +					 GFP_KERNEL);
> +	if (!data)
> +		return -ENOMEM;
> +
> +	spin_lock_init(&data->susp_lock);
> +	return 0;

I guess it's ok, I just don't like doing data initialization on the
"out" path, it's messy.

Care to neaten this up a bit more and resend it?  Perhaps just free the
memory on the error path instead of moving it later on?

thanks,

greg k-h

Re: [PATCH] qcserial: fix a memory leak in qcprobe error path

[Axel Lin]

hi Greg,

2010/6/15 Greg KH <greg@kroah.com>:
> On Tue, Jun 08, 2010 at 03:29:23PM +0800, Axel Lin wrote:
>> In current implemtation, the "data" is not kfreed in qcprobe error path.
>> This patch moves the memory allocation a little bit latter and only
>> allocate memory when no error is detected in previous checking.
>
> Yeah, but it's now pretty messy.
>
>> --- a/drivers/usb/serial/qcserial.c
>> +++ b/drivers/usb/serial/qcserial.c
>> @@ -109,13 +109,6 @@ static int qcprobe(struct usb_serial *serial, const struct usb_device_id *id)
>>       ifnum = intf->desc.bInterfaceNumber;
>>       dbg("This Interface = %d", ifnum);
>>
>> -     data = serial->private = kzalloc(sizeof(struct usb_wwan_intf_private),
>> -                                      GFP_KERNEL);
>> -     if (!data)
>> -             return -ENOMEM;
>> -
>> -     spin_lock_init(&data->susp_lock);
>> -
>
> Moving this to the end is fine.
>
>> @@ -140,7 +135,7 @@ static int qcprobe(struct usb_serial *serial, const struct usb_device_id *id)
>>                                       retval);
>>                               retval = -ENODEV;
>>                       }
>> -                     return retval;
>> +                     goto out;
>
> But this doesn't need to be changed, right?
> Or this.
>
>>               }
>>               break;
>>
>> @@ -156,17 +151,26 @@ static int qcprobe(struct usb_serial *serial, const struct usb_device_id *id)
>>                                       retval);
>>                               retval = -ENODEV;
>>                       }
>> -                     return retval;
>> +                     goto out;
>
> Or this?
>
>>               }
>>               break;
>>
>>       default:
>>               dev_err(&serial->dev->dev,
>>                       "unknown number of interfaces: %d\n", nintf);
>> -             return -ENODEV;
>
> Hm. maybe.
>
>>       }
>>
>> -     return retval;
>> +out:
>> +     if (retval)
>> +             return retval;
>> +
>> +     data = serial->private = kzalloc(sizeof(struct usb_wwan_intf_private),
>> +                                      GFP_KERNEL);
>> +     if (!data)
>> +             return -ENOMEM;
>> +
>> +     spin_lock_init(&data->susp_lock);
>> +     return 0;
>
> I guess it's ok, I just don't like doing data initialization on the
> "out" path, it's messy.
>
> Care to neaten this up a bit more and resend it?  Perhaps just free the
> memory on the error path instead of moving it later on?

I will send a revised patch that just free the memory on the error path.
Thanks for the review.

Axel
>
> thanks,
>
> greg k-h
>