can: usb_8dev: fix urb leak on failure path in usb_8dev_start()

If usb_8dev_start() fails to submit urb,
it unanchors the urb but forgets to free it.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
---
 drivers/net/can/usb/usb_8dev.c | 1 +
 1 file changed, 1 insertion(+)

On 07/17/2013 11:20 PM, Alexey Khoroshilov wrote:
> If usb_8dev_start() fails to submit urb,
> it unanchors the urb but forgets to free it.
> 
> Found by Linux Driver Verification project (linuxtesting.org).
> 
> Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>

Thanks, added to can/fixes-for-3.11

Marc

Thanks!

Added to repository on github: https://github.com/krumboeck/usb2can

regards,
Bernd


Am 2013-07-17 23:20, schrieb Alexey Khoroshilov:
> If usb_8dev_start() fails to submit urb,
> it unanchors the urb but forgets to free it.
>
> Found by Linux Driver Verification project (linuxtesting.org).
>
> Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
> ---
>   drivers/net/can/usb/usb_8dev.c | 1 +
>   1 file changed, 1 insertion(+)
>
> diff --git a/drivers/net/can/usb/usb_8dev.c b/drivers/net/can/usb/usb_8dev.c
> index cbd388e..8becd3d 100644
> --- a/drivers/net/can/usb/usb_8dev.c
> +++ b/drivers/net/can/usb/usb_8dev.c
> @@ -779,6 +779,7 @@ static int usb_8dev_start(struct usb_8dev_priv *priv)
>   			usb_unanchor_urb(urb);
>   			usb_free_coherent(priv->udev, RX_BUFFER_SIZE, buf,
>   					  urb->transfer_dma);
> +			usb_free_urb(urb);
>   			break;
>   		}
>
>

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html