redonkable/alistair23-linux
redonkable/alistair23-linux
1
0
Fork 0
Code Releases Activity

USB: spcp8x5: fix port-data memory leak

Browse source 
Fix port-data memory leak by replacing attach and release with
port_probe and port_remove.

Since commit 0998d06310 (device-core: Ensure drvdata = NULL when no
driver is bound) the port private data is no longer freed at release as
it is no longer accessible.

Compile-only tested.

Cc: <stable@vger.kernel.org>
Signed-off-by: Johan Hovold <jhovold@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Johan Hovold 2012-10-17 16:31:33 +02:00 committed by Greg Kroah-Hartman
parent 638b9e1523
commit bf90ff5f3b
1 changed files with 18 additions and 28 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

46
drivers/usb/serial/spcp8x5.c
View file

@ -157,13 +157,10 @@ struct spcp8x5_private {
u8 line_status; u8 line_status;
}; };
/* desc : when device plug in,this function would be called. static int spcp8x5_port_probe(struct usb_serial_port *port)
* thanks to usb_serial subsystem,then do almost every things for us. And what
* we should do just alloc the buffer */
static int spcp8x5_startup(struct usb_serial *serial)
{ {
struct usb_serial *serial = port->serial;
struct spcp8x5_private *priv; struct spcp8x5_private *priv;
int i;
enum spcp8x5_type type = SPCP825_007_TYPE; enum spcp8x5_type type = SPCP825_007_TYPE;
u16 product = le16_to_cpu(serial->dev->descriptor.idProduct); u16 product = le16_to_cpu(serial->dev->descriptor.idProduct);
@ -180,34 +177,27 @@ static int spcp8x5_startup(struct usb_serial *serial)
type = SPCP825_PHILIP_TYPE; type = SPCP825_PHILIP_TYPE;
dev_dbg(&serial->dev->dev, "device type = %d\n", (int)type); dev_dbg(&serial->dev->dev, "device type = %d\n", (int)type);
for (i = 0; i < serial->num_ports; ++i) { priv = kzalloc(sizeof(*priv), GFP_KERNEL);
priv = kzalloc(sizeof(struct spcp8x5_private), GFP_KERNEL); if (!priv)
if (!priv) return -ENOMEM;
goto cleanup;
spin_lock_init(&priv->lock); spin_lock_init(&priv->lock);
init_waitqueue_head(&priv->delta_msr_wait); init_waitqueue_head(&priv->delta_msr_wait);
priv->type = type; priv->type = type;
usb_set_serial_port_data(serial->port[i] , priv);
} usb_set_serial_port_data(port , priv);
return 0; return 0;
cleanup:
for (--i; i >= 0; --i) {
priv = usb_get_serial_port_data(serial->port[i]);
kfree(priv);
usb_set_serial_port_data(serial->port[i] , NULL);
}
return -ENOMEM;
} }
/* call when the device plug out. free all the memory alloced by probe */ static int spcp8x5_port_remove(struct usb_serial_port *port)
static void spcp8x5_release(struct usb_serial *serial)
{ {
int i; struct spcp8x5_private *priv;
for (i = 0; i < serial->num_ports; i++) priv = usb_get_serial_port_data(port);
kfree(usb_get_serial_port_data(serial->port[i])); kfree(priv);
return 0;
} }
/* set the modem control line of the device. /* set the modem control line of the device.
@ -649,8 +639,8 @@ static struct usb_serial_driver spcp8x5_device = {
.ioctl = spcp8x5_ioctl, .ioctl = spcp8x5_ioctl,
.tiocmget = spcp8x5_tiocmget, .tiocmget = spcp8x5_tiocmget,
.tiocmset = spcp8x5_tiocmset, .tiocmset = spcp8x5_tiocmset,
.attach = spcp8x5_startup, .port_probe = spcp8x5_port_probe,
.release = spcp8x5_release, .port_remove = spcp8x5_port_remove,
.process_read_urb = spcp8x5_process_read_urb, .process_read_urb = spcp8x5_process_read_urb,
}; };