Commit c5b5d09d authored by Alexey Khoroshilov's avatar Alexey Khoroshilov Committed by Willy Tarreau

usbvision: fix leak of usb_dev on failure paths in usbvision_probe()

commit afd270d1 upstream.

There is no usb_put_dev() on failure paths in usbvision_probe().

Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: default avatarAlexey Khoroshilov <khoroshilov@ispras.ru>
Signed-off-by: default avatarHans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@osg.samsung.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarWilly Tarreau <w@1wt.eu>
parent 6645b827
...@@ -1521,7 +1521,7 @@ static int usbvision_probe(struct usb_interface *intf, ...@@ -1521,7 +1521,7 @@ static int usbvision_probe(struct usb_interface *intf,
const struct usb_host_interface *interface; const struct usb_host_interface *interface;
struct usb_usbvision *usbvision = NULL; struct usb_usbvision *usbvision = NULL;
const struct usb_endpoint_descriptor *endpoint; const struct usb_endpoint_descriptor *endpoint;
int model, i; int model, i, ret;
PDEBUG(DBG_PROBE, "VID=%#04x, PID=%#04x, ifnum=%u", PDEBUG(DBG_PROBE, "VID=%#04x, PID=%#04x, ifnum=%u",
dev->descriptor.idVendor, dev->descriptor.idVendor,
...@@ -1530,7 +1530,8 @@ static int usbvision_probe(struct usb_interface *intf, ...@@ -1530,7 +1530,8 @@ static int usbvision_probe(struct usb_interface *intf,
model = devid->driver_info; model = devid->driver_info;
if (model < 0 || model >= usbvision_device_data_size) { if (model < 0 || model >= usbvision_device_data_size) {
PDEBUG(DBG_PROBE, "model out of bounds %d", model); PDEBUG(DBG_PROBE, "model out of bounds %d", model);
return -ENODEV; ret = -ENODEV;
goto err_usb;
} }
printk(KERN_INFO "%s: %s found\n", __func__, printk(KERN_INFO "%s: %s found\n", __func__,
usbvision_device_data[model].model_string); usbvision_device_data[model].model_string);
...@@ -1545,18 +1546,21 @@ static int usbvision_probe(struct usb_interface *intf, ...@@ -1545,18 +1546,21 @@ static int usbvision_probe(struct usb_interface *intf,
__func__, ifnum); __func__, ifnum);
dev_err(&intf->dev, "%s: Endpoint attributes %d", dev_err(&intf->dev, "%s: Endpoint attributes %d",
__func__, endpoint->bmAttributes); __func__, endpoint->bmAttributes);
return -ENODEV; ret = -ENODEV;
goto err_usb;
} }
if (usb_endpoint_dir_out(endpoint)) { if (usb_endpoint_dir_out(endpoint)) {
dev_err(&intf->dev, "%s: interface %d. has ISO OUT endpoint!\n", dev_err(&intf->dev, "%s: interface %d. has ISO OUT endpoint!\n",
__func__, ifnum); __func__, ifnum);
return -ENODEV; ret = -ENODEV;
goto err_usb;
} }
usbvision = usbvision_alloc(dev, intf); usbvision = usbvision_alloc(dev, intf);
if (usbvision == NULL) { if (usbvision == NULL) {
dev_err(&intf->dev, "%s: couldn't allocate USBVision struct\n", __func__); dev_err(&intf->dev, "%s: couldn't allocate USBVision struct\n", __func__);
return -ENOMEM; ret = -ENOMEM;
goto err_usb;
} }
if (dev->descriptor.bNumConfigurations > 1) if (dev->descriptor.bNumConfigurations > 1)
...@@ -1575,8 +1579,8 @@ static int usbvision_probe(struct usb_interface *intf, ...@@ -1575,8 +1579,8 @@ static int usbvision_probe(struct usb_interface *intf,
usbvision->alt_max_pkt_size = kmalloc(32 * usbvision->num_alt, GFP_KERNEL); usbvision->alt_max_pkt_size = kmalloc(32 * usbvision->num_alt, GFP_KERNEL);
if (usbvision->alt_max_pkt_size == NULL) { if (usbvision->alt_max_pkt_size == NULL) {
dev_err(&intf->dev, "usbvision: out of memory!\n"); dev_err(&intf->dev, "usbvision: out of memory!\n");
usbvision_release(usbvision); ret = -ENOMEM;
return -ENOMEM; goto err_pkt;
} }
for (i = 0; i < usbvision->num_alt; i++) { for (i = 0; i < usbvision->num_alt; i++) {
...@@ -1611,6 +1615,12 @@ static int usbvision_probe(struct usb_interface *intf, ...@@ -1611,6 +1615,12 @@ static int usbvision_probe(struct usb_interface *intf,
PDEBUG(DBG_PROBE, "success"); PDEBUG(DBG_PROBE, "success");
return 0; return 0;
err_pkt:
usbvision_release(usbvision);
err_usb:
usb_put_dev(dev);
return ret;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment