Re: [CHECKER] 32 Memory Leaks on Error Paths

[Chris Wright <chrisw@osdl.org>]

* David Yu Chen (dychen@stanford.edu) wrote:
> Leaks if devices == 0 ?  Error_end only frees mdevs if (devices > 0), 
> but for mdevs=kmalloc(0), the slab allocator may still actually return memory
> [FILE:  2.6.0-test5/drivers/usb/class/usb-midi.c]
> [FUNC:  alloc_usb_midi_device]
> [LINES: 1621-1772]
> [VAR:   mdevs]
> 1616:	devices = inDevs > outDevs ? inDevs : outDevs;
> 1617:	devices = maxdevices > devices ? devices : maxdevices;
> 1618:
> 1619:	/* obtain space for device name (iProduct) if not known. */
> 1620:	if ( ! u->deviceName ) {
> START -->
> 1621:		mdevs = (struct usb_mididev **)
> 1622:			kmalloc(sizeof(struct usb_mididevs *)*devices
> 1623:				+ sizeof(char) * 256, GFP_KERNEL);
<snip>
> GOTO -->
> 1715:			goto error_end;
<snip>
> END -->
> 1772:	return -ENOMEM;
> [FILE:  2.6.0-test5/drivers/usb/class/usb-midi.c]
> START -->
> 1625:		mdevs = (struct usb_mididev **)
> 1626:			kmalloc(sizeof(struct usb_mididevs *)*devices, GFP_KERNEL);
<snip>
> GOTO -->
> 1715:			goto error_end;
<snip>
> END -->
> 1772:	return -ENOMEM;

Yes, these are bugs.  Patch below.  Greg, this look ok?

thanks,
-chris

===== drivers/usb/class/usb-midi.c 1.22 vs edited =====
--- 1.22/drivers/usb/class/usb-midi.c	Tue Sep  2 11:40:27 2003
+++ edited/drivers/usb/class/usb-midi.c	Tue Sep 23 11:36:03 2003
@@ -1750,7 +1750,7 @@
 	return 0;
 
  error_end:
-	if ( mdevs != NULL && devices > 0 ) {
+	if ( mdevs != NULL ) {
 		for ( i=0 ; i<devices ; i++ ) {
 			if ( mdevs[i] != NULL ) {
 				unregister_sound_midi( mdevs[i]->dev_midi );