tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe()

In hfcsusb_probe(), the memory allocated for ctrl_urb gets leaked when
setup_instance() fails with an error code. Fix that by freeing the urb
before freeing the hw structure. Also change the error paths to use the
goto ladder style.

Compile tested only. Issue found using a prototype static analysis tool.

Fixes: 69f52adb2d53 ("mISDN: Add HFC USB driver")
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
Link: https://patch.msgid.link/20251030042524.194812-1-nihaal@cse.iitm.ac.in
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

authored by

Abdun Nihaal and committed by
Jakub Kicinski 3f978e3f f8e84867

+13 -5
+13 -5
drivers/isdn/hardware/mISDN/hfcsusb.c
··· 1904 1904 mISDN_freebchannel(&hw->bch[1]); 1905 1905 mISDN_freebchannel(&hw->bch[0]); 1906 1906 mISDN_freedchannel(&hw->dch); 1907 - kfree(hw); 1908 1907 return err; 1909 1908 } 1910 1909 1911 1910 static int 1912 1911 hfcsusb_probe(struct usb_interface *intf, const struct usb_device_id *id) 1913 1912 { 1913 + int err; 1914 1914 struct hfcsusb *hw; 1915 1915 struct usb_device *dev = interface_to_usbdev(intf); 1916 1916 struct usb_host_interface *iface = intf->cur_altsetting; ··· 2101 2101 if (!hw->ctrl_urb) { 2102 2102 pr_warn("%s: No memory for control urb\n", 2103 2103 driver_info->vend_name); 2104 - kfree(hw); 2105 - return -ENOMEM; 2104 + err = -ENOMEM; 2105 + goto err_free_hw; 2106 2106 } 2107 2107 2108 2108 pr_info("%s: %s: detected \"%s\" (%s, if=%d alt=%d)\n", 2109 2109 hw->name, __func__, driver_info->vend_name, 2110 2110 conf_str[small_match], ifnum, alt_used); 2111 2111 2112 - if (setup_instance(hw, dev->dev.parent)) 2113 - return -EIO; 2112 + if (setup_instance(hw, dev->dev.parent)) { 2113 + err = -EIO; 2114 + goto err_free_urb; 2115 + } 2114 2116 2115 2117 hw->intf = intf; 2116 2118 usb_set_intfdata(hw->intf, hw); 2117 2119 return 0; 2120 + 2121 + err_free_urb: 2122 + usb_free_urb(hw->ctrl_urb); 2123 + err_free_hw: 2124 + kfree(hw); 2125 + return err; 2118 2126 } 2119 2127 2120 2128 /* function called when an active device is removed */