drm/udl: Fix potential URB leaks

A couple of error handlings forgot to process the URB completion.
Those are both with WARN_ON() so should be visible, but we must fix
them in anyway.

Fixes: 7350b2a3fbc6 ("drm/udl: Replace BUG_ON() with WARN_ON()")
Acked-by: Thomas Zimmermann <tzimmermann@suse.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://patchwork.freedesktop.org/patch/msgid/20220908095115.23396-10-tiwai@suse.de

diff --git a/drivers/gpu/drm/udl/udl_main.c b/drivers/gpu/drm/udl/udl_main.c
index 2b7eafd48ec214f39a2e537eb3f16c7273739732..de28eeff3155d50fc12a55e8efb68000f107e9e7 100644 (file)
--- a/drivers/gpu/drm/udl/udl_main.c
+++ b/drivers/gpu/drm/udl/udl_main.c
@@ -260,11 +260,13 @@ int udl_submit_urb(struct drm_device *dev, struct urb *urb, size_t len)
        struct udl_device *udl = to_udl(dev);
        int ret;
 
-       if (WARN_ON(len > udl->urbs.size))
-               return -EINVAL;
-
+       if (WARN_ON(len > udl->urbs.size)) {
+               ret = -EINVAL;
+               goto error;
+       }
        urb->transfer_buffer_length = len; /* set to actual payload len */
        ret = usb_submit_urb(urb, GFP_ATOMIC);
+ error:
        if (ret) {
                udl_urb_completion(urb); /* because no one else will */
                DRM_ERROR("usb_submit_urb error %x\n", ret);

diff --git a/drivers/gpu/drm/udl/udl_transfer.c b/drivers/gpu/drm/udl/udl_transfer.c
index a431208dda858f5c7d009efe3847e281fc719898..b57844632dbd74ce69c3fe79d46d63c38c952cfc 100644 (file)
--- a/drivers/gpu/drm/udl/udl_transfer.c
+++ b/drivers/gpu/drm/udl/udl_transfer.c
@@ -180,8 +180,11 @@ int udl_render_hline(struct drm_device *dev, int log_bpp, struct urb **urb_ptr,
        u8 *cmd = *urb_buf_ptr;
        u8 *cmd_end = (u8 *) urb->transfer_buffer + urb->transfer_buffer_length;
 
-       if (WARN_ON(!(log_bpp == 1 || log_bpp == 2)))
+       if (WARN_ON(!(log_bpp == 1 || log_bpp == 2))) {
+               /* need to finish URB at error from this function */
+               udl_urb_completion(urb);
                return -EINVAL;
+       }
 
        line_start = (u8 *) (front + byte_offset);
        next_pixel = line_start;