[PATCH] usb: host: sl811_cs: fix memory leak on probe failure

[PATCH] usb: host: sl811_cs: fix memory leak on probe failure

[Zongmin Zhou]

From: Zongmin Zhou <zhouzongmin@kylinos.cn>

sl811_cs_probe() leaks the local_info_t allocated into link->priv when
sl811_cs_config() fails: the only kfree() lives in the remove callback
sl811_cs_detach(), which the PCMCIA core never calls for a device whose
probe failed.

Free the private data when sl811_cs_config() fails.

Fixes: c6de2b64eb57 ("[PATCH] USB: add sl811_cs support")
Signed-off-by: Zongmin Zhou <zhouzongmin@kylinos.cn>
---
 drivers/usb/host/sl811_cs.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/host/sl811_cs.c b/drivers/usb/host/sl811_cs.c
index ada91ca33f65..fd0cd541bf53 100644
--- a/drivers/usb/host/sl811_cs.c
+++ b/drivers/usb/host/sl811_cs.c
@@ -177,6 +177,7 @@ failed:
 static int sl811_cs_probe(struct pcmcia_device *link)
 {
 	local_info_t *local;
+	int ret;
 
 	local = kzalloc_obj(local_info_t);
 	if (!local)
@@ -184,7 +185,11 @@ static int sl811_cs_probe(struct pcmcia_device *link)
 	local->p_dev = link;
 	link->priv = local;
 
-	return sl811_cs_config(link);
+	ret = sl811_cs_config(link);
+	if (ret)
+		kfree(local);
+
+	return ret;
 }
 
 static const struct pcmcia_device_id sl811_ids[] = {
-- 
2.34.1


No virus found
		Checked by Hillstone Network AntiVirus

Re: [PATCH] usb: host: sl811_cs: fix memory leak on probe failure

[Nikolay Kulikov]

On Thu, Aug 27, 2026 at 03:41:20PM +0800, Zongmin Zhou wrote:
> From: Zongmin Zhou <zhouzongmin@kylinos.cn>
> 
> sl811_cs_probe() leaks the local_info_t allocated into link->priv when
> sl811_cs_config() fails: the only kfree() lives in the remove callback
> sl811_cs_detach(), which the PCMCIA core never calls for a device whose
> probe failed.
> 
> Free the private data when sl811_cs_config() fails.
> 
> Fixes: c6de2b64eb57 ("[PATCH] USB: add sl811_cs support")

The code looks good to me, but I have a question regarding the Fixes
tag.

In the commit you cited, a failure triggered a call to
sl811_cs_detach(), which freed that memory. However, that behavior was
changed in commit

f8cfa618dccb ("[PATCH] pcmcia: unify attach, EVENT_CARD_INSERTION handlers into one probe callback")

where the call was removed, leaving the memory unfreed. Shouldn't that
be the commit referenced in the Fixes?


Thanks,
Nikolay