Commit 48c3375c authored by Alan Stern's avatar Alan Stern Committed by Sarah Sharp

USB: XHCI: fix memory leak of URB-private data

This patch (as1640) fixes a memory leak in xhci-hcd.  The urb_priv
data structure isn't always deallocated in the handle_tx_event()
routine for non-control transfers.  The patch adds a kfree() call so
that all paths end up freeing the memory properly.

This patch should be backported to kernels as old as 2.6.36, that
contain the commit 8e51adcc "USB: xHCI:
Introduce urb_priv structure"
Signed-off-by: default avatarAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: default avatarSarah Sharp <sarah.a.sharp@linux.intel.com>
Reported-and-tested-by: default avatarMartin Mokrejs <mmokrejs@fold.natur.cuni.cz>
CC: <stable@vger.kernel.org>
parent ba7b5c22
...@@ -2589,6 +2589,8 @@ static int handle_tx_event(struct xhci_hcd *xhci, ...@@ -2589,6 +2589,8 @@ static int handle_tx_event(struct xhci_hcd *xhci,
(trb_comp_code != COMP_STALL && (trb_comp_code != COMP_STALL &&
trb_comp_code != COMP_BABBLE)) trb_comp_code != COMP_BABBLE))
xhci_urb_free_priv(xhci, urb_priv); xhci_urb_free_priv(xhci, urb_priv);
else
kfree(urb_priv);
usb_hcd_unlink_urb_from_ep(bus_to_hcd(urb->dev->bus), urb); usb_hcd_unlink_urb_from_ep(bus_to_hcd(urb->dev->bus), urb);
if ((urb->actual_length != urb->transfer_buffer_length && if ((urb->actual_length != urb->transfer_buffer_length &&
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment