提交 11ec7588 编写于 作者: L Lu Baolu 提交者: Greg Kroah-Hartman

usb: xhci: Fix memory leak when xhci_disable_slot() returns error

If xhci_disable_slot() returns success, a disable slot command
trb was queued in the command ring. The command completion
handler will free the virtual device data structure associated
with the slot. On the other hand, when xhci_disable_slot()
returns error, the invokers should take the responsibilities to
free the slot related data structure. Otherwise, memory leakage
happens.
Signed-off-by: NLu Baolu <baolu.lu@linux.intel.com>
Signed-off-by: NMathias Nyman <mathias.nyman@linux.intel.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
上级 cd3f1790
...@@ -3561,11 +3561,9 @@ static void xhci_free_dev(struct usb_hcd *hcd, struct usb_device *udev) ...@@ -3561,11 +3561,9 @@ static void xhci_free_dev(struct usb_hcd *hcd, struct usb_device *udev)
del_timer_sync(&virt_dev->eps[i].stop_cmd_timer); del_timer_sync(&virt_dev->eps[i].stop_cmd_timer);
} }
xhci_disable_slot(xhci, udev->slot_id); ret = xhci_disable_slot(xhci, udev->slot_id);
/* if (ret)
* Event command completion handler will free any data structures xhci_free_virt_device(xhci, udev->slot_id);
* associated with the slot. XXX Can free sleep?
*/
} }
int xhci_disable_slot(struct xhci_hcd *xhci, u32 slot_id) int xhci_disable_slot(struct xhci_hcd *xhci, u32 slot_id)
...@@ -3713,7 +3711,11 @@ int xhci_alloc_dev(struct usb_hcd *hcd, struct usb_device *udev) ...@@ -3713,7 +3711,11 @@ int xhci_alloc_dev(struct usb_hcd *hcd, struct usb_device *udev)
return 1; return 1;
disable_slot: disable_slot:
return xhci_disable_slot(xhci, udev->slot_id); ret = xhci_disable_slot(xhci, udev->slot_id);
if (ret)
xhci_free_virt_device(xhci, udev->slot_id);
return 0;
} }
/* /*
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册