Commit 2e6d01ff authored by Olivier Sobrie's avatar Olivier Sobrie Committed by David S. Miller

hso: fix memory leak in hso_create_rfkill()

When the rfkill interface was created, a buffer containing the name
of the rfkill node was allocated. This buffer was never freed when the
device disappears.

To fix the problem, we put the name given to rfkill_alloc() in
the hso_net structure.
Signed-off-by: default avatarOlivier Sobrie <olivier@sobrie.be>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 295fc56f
...@@ -153,6 +153,7 @@ struct hso_net { ...@@ -153,6 +153,7 @@ struct hso_net {
struct hso_device *parent; struct hso_device *parent;
struct net_device *net; struct net_device *net;
struct rfkill *rfkill; struct rfkill *rfkill;
char name[8];
struct usb_endpoint_descriptor *in_endp; struct usb_endpoint_descriptor *in_endp;
struct usb_endpoint_descriptor *out_endp; struct usb_endpoint_descriptor *out_endp;
...@@ -2467,27 +2468,20 @@ static void hso_create_rfkill(struct hso_device *hso_dev, ...@@ -2467,27 +2468,20 @@ static void hso_create_rfkill(struct hso_device *hso_dev,
{ {
struct hso_net *hso_net = dev2net(hso_dev); struct hso_net *hso_net = dev2net(hso_dev);
struct device *dev = &hso_net->net->dev; struct device *dev = &hso_net->net->dev;
char *rfkn;
rfkn = kzalloc(20, GFP_KERNEL); snprintf(hso_net->name, sizeof(hso_net->name), "hso-%d",
if (!rfkn)
dev_err(dev, "%s - Out of memory\n", __func__);
snprintf(rfkn, 20, "hso-%d",
interface->altsetting->desc.bInterfaceNumber); interface->altsetting->desc.bInterfaceNumber);
hso_net->rfkill = rfkill_alloc(rfkn, hso_net->rfkill = rfkill_alloc(hso_net->name,
&interface_to_usbdev(interface)->dev, &interface_to_usbdev(interface)->dev,
RFKILL_TYPE_WWAN, RFKILL_TYPE_WWAN,
&hso_rfkill_ops, hso_dev); &hso_rfkill_ops, hso_dev);
if (!hso_net->rfkill) { if (!hso_net->rfkill) {
dev_err(dev, "%s - Out of memory\n", __func__); dev_err(dev, "%s - Out of memory\n", __func__);
kfree(rfkn);
return; return;
} }
if (rfkill_register(hso_net->rfkill) < 0) { if (rfkill_register(hso_net->rfkill) < 0) {
rfkill_destroy(hso_net->rfkill); rfkill_destroy(hso_net->rfkill);
kfree(rfkn);
hso_net->rfkill = NULL; hso_net->rfkill = NULL;
dev_err(dev, "%s - Failed to register rfkill\n", __func__); dev_err(dev, "%s - Failed to register rfkill\n", __func__);
return; return;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment