Commit 89473129 authored by Alexey Khoroshilov's avatar Alexey Khoroshilov Committed by David S. Miller

net/irda/mcs7780: fix memory leaks in mcs_net_open()

If rx_urb allocation fails in mcs_setup_urbs(), tx_urb leaks.
If mcs_receive_start() fails in mcs_net_open(), the both urbs are not deallocated.

The patch fixes the issues and by the way fixes label indentation.

Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: default avatarAlexey Khoroshilov <khoroshilov@ispras.ru>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 38463e2c
...@@ -191,8 +191,8 @@ static inline int mcs_setup_transceiver_vishay(struct mcs_cb *mcs) ...@@ -191,8 +191,8 @@ static inline int mcs_setup_transceiver_vishay(struct mcs_cb *mcs)
goto error; goto error;
ret = 0; ret = 0;
error: error:
return ret; return ret;
} }
/* Setup a communication between mcs7780 and agilent chip. */ /* Setup a communication between mcs7780 and agilent chip. */
...@@ -501,8 +501,11 @@ static inline int mcs_setup_urbs(struct mcs_cb *mcs) ...@@ -501,8 +501,11 @@ static inline int mcs_setup_urbs(struct mcs_cb *mcs)
return 0; return 0;
mcs->rx_urb = usb_alloc_urb(0, GFP_KERNEL); mcs->rx_urb = usb_alloc_urb(0, GFP_KERNEL);
if (!mcs->rx_urb) if (!mcs->rx_urb) {
usb_free_urb(mcs->tx_urb);
mcs->tx_urb = NULL;
return 0; return 0;
}
return 1; return 1;
} }
...@@ -643,9 +646,9 @@ static int mcs_speed_change(struct mcs_cb *mcs) ...@@ -643,9 +646,9 @@ static int mcs_speed_change(struct mcs_cb *mcs)
ret = mcs_set_reg(mcs, MCS_MODE_REG, rval); ret = mcs_set_reg(mcs, MCS_MODE_REG, rval);
mcs->speed = mcs->new_speed; mcs->speed = mcs->new_speed;
error: error:
mcs->new_speed = 0; mcs->new_speed = 0;
return ret; return ret;
} }
/* Ioctl calls not supported at this time. Can be an area of future work. */ /* Ioctl calls not supported at this time. Can be an area of future work. */
...@@ -738,17 +741,20 @@ static int mcs_net_open(struct net_device *netdev) ...@@ -738,17 +741,20 @@ static int mcs_net_open(struct net_device *netdev)
ret = mcs_receive_start(mcs); ret = mcs_receive_start(mcs);
if (ret) if (ret)
goto error3; goto error4;
netif_start_queue(netdev); netif_start_queue(netdev);
return 0; return 0;
error3: error4:
irlap_close(mcs->irlap); usb_free_urb(mcs->rx_urb);
error2: usb_free_urb(mcs->tx_urb);
kfree_skb(mcs->rx_buff.skb); error3:
error1: irlap_close(mcs->irlap);
return ret; error2:
kfree_skb(mcs->rx_buff.skb);
error1:
return ret;
} }
/* Receive callback function. */ /* Receive callback function. */
...@@ -946,11 +952,11 @@ static int mcs_probe(struct usb_interface *intf, ...@@ -946,11 +952,11 @@ static int mcs_probe(struct usb_interface *intf,
usb_set_intfdata(intf, mcs); usb_set_intfdata(intf, mcs);
return 0; return 0;
error2: error2:
free_netdev(ndev); free_netdev(ndev);
error1: error1:
return ret; return ret;
} }
/* The current device is removed, the USB layer tells us to shut down. */ /* The current device is removed, the USB layer tells us to shut down. */
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment