greybus: es2: fix memory leak in probe error path
authorJohan Hovold <johan@hovoldconsulting.com>
Wed, 17 Aug 2016 13:43:32 +0000 (15:43 +0200)
committerGreg Kroah-Hartman <gregkh@google.com>
Wed, 17 Aug 2016 13:59:13 +0000 (15:59 +0200)
In case a bulk-in transfer-buffer allocation failed during probe, we'd
currently leak the corresponding URB.

Signed-off-by: Johan Hovold <johan@hovoldconsulting.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
drivers/staging/greybus/es2.c

index 7f46f2a9183386fd08e0d7de1483e28e64a88f08..8803bc9d410dbbfc1a9595aeb1e16a6c2a63f7d4 100644 (file)
@@ -1623,6 +1623,8 @@ static int ap_probe(struct usb_interface *interface,
                                retval = -ENOMEM;
                                goto error;
                        }
+                       cport_in->urb[i] = urb;
+
                        buffer = kmalloc(ES2_GBUF_MSG_SIZE_MAX, GFP_KERNEL);
                        if (!buffer) {
                                retval = -ENOMEM;
@@ -1634,7 +1636,7 @@ static int ap_probe(struct usb_interface *interface,
                                                          cport_in->endpoint),
                                          buffer, ES2_GBUF_MSG_SIZE_MAX,
                                          cport_in_callback, hd);
-                       cport_in->urb[i] = urb;
+
                        cport_in->buffer[i] = buffer;
                }
        }
@@ -1649,6 +1651,8 @@ static int ap_probe(struct usb_interface *interface,
                        retval = -ENOMEM;
                        goto error;
                }
+               es2->arpc_urb[i] = urb;
+
                buffer = kmalloc(ARPC_IN_SIZE_MAX, GFP_KERNEL);
                if (!buffer) {
                        retval = -ENOMEM;
@@ -1661,7 +1665,6 @@ static int ap_probe(struct usb_interface *interface,
                                  buffer, ARPC_IN_SIZE_MAX,
                                  arpc_in_callback, es2);
 
-               es2->arpc_urb[i] = urb;
                es2->arpc_buffer[i] = buffer;
        }