From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753334AbcADVlx (ORCPT ); Mon, 4 Jan 2016 16:41:53 -0500 Received: from mail-wm0-f44.google.com ([74.125.82.44]:37095 "EHLO mail-wm0-f44.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752325AbcADVlt (ORCPT ); Mon, 4 Jan 2016 16:41:49 -0500 From: Michal Nazarewicz To: Felipe Balbi , "Du, Changbin" Cc: Greg Kroah-Hartman , Al Viro , Robert Baldyga , linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org, Michal Nazarewicz Subject: [PATCH 1/5] usb: f_fs: fix memory leak when ep changes during transfer Date: Mon, 4 Jan 2016 22:41:37 +0100 Message-Id: <1451943701-18212-1-git-send-email-mina86@mina86.com> X-Mailer: git-send-email 2.6.0.rc2.230.g3dd15c0 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org In the ffs_epfile_io function, data buffer is allocated for non-halt requests. Later, after grabing a mutex, the function checks that epfile->ep is still ep and if it’s not, it set ret to -ESHUTDOWN and follow a path including spin_unlock_irq (just after ‘ret = -ESHUTDOWN’), mutex_unlock (after if-else-if-else chain) and returns ret. Noticeably, this does not include freeing of the data buffer. Fix by introducing a goto which moves control flow to the the end of the function where spin_unlock_irq, mutex_unlock and kfree are all called. Signed-off-by: Michal Nazarewicz --- drivers/usb/gadget/function/f_fs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c index cf43e9e..d1a4a86 100644 --- a/drivers/usb/gadget/function/f_fs.c +++ b/drivers/usb/gadget/function/f_fs.c @@ -763,7 +763,7 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data) if (epfile->ep != ep) { /* In the meantime, endpoint got disabled or changed. */ ret = -ESHUTDOWN; - spin_unlock_irq(&epfile->ffs->eps_lock); + goto error_lock; } else if (halt) { /* Halt */ if (likely(epfile->ep == ep) && !WARN_ON(!ep->ep)) -- 2.6.0.rc2.230.g3dd15c0