2007-08-09 21:05:13

by Jesper Juhl

Subject: [PATCH] Fix a memory leak in em28xx_usb_probe()

EHLO,

If, in em28xx_usb_probe() the memory allocation
dev->alt_max_pkt_size = kmalloc(32*
dev->num_alt,GFP_KERNEL);
fails, then we'll bail out and return -ENOMEM.
The problem is that in that case we don't free the storage allocated
to 'dev', thus causing a memory leak.

This patch fixes the leak by freeing 'dev' before we return -ENOMEM.
This fixes Coverity bug #647.


Signed-off-by: Jesper Juhl <[email protected]>
---

drivers/media/video/em28xx/em28xx-video.c | 1 +
1 files changed, 1 insertions(+), 0 deletions(-)

diff --git a/drivers/media/video/em28xx/em28xx-video.c b/drivers/media/video/em28xx/em28xx-video.c
index 2c7b158..40307f3 100644
--- a/drivers/media/video/em28xx/em28xx-video.c
+++ b/drivers/media/video/em28xx/em28xx-video.c
@@ -1772,6 +1772,7 @@ static int em28xx_usb_probe(struct usb_interface *interface,
if (dev->alt_max_pkt_size == NULL) {
em28xx_errdev("out of memory!\n");
em28xx_devused&=~(1<<nr);
+ kfree(dev);
return -ENOMEM;
}

2007-08-15 19:49:26

by Markus Rechberger

Subject: Re: [PATCH] Fix a memory leak in em28xx_usb_probe()

Hi Jesper,

On 8/9/07, Jesper Juhl <[email protected]> wrote:
> EHLO,
>
> If, in em28xx_usb_probe() the memory allocation
> dev->alt_max_pkt_size = kmalloc(32*
> dev->num_alt,GFP_KERNEL);
> fails, then we'll bail out and return -ENOMEM.
> The problem is that in that case we don't free the storage allocated
> to 'dev', thus causing a memory leak.
>
> This patch fixes the leak by freeing 'dev' before we return -ENOMEM.
> This fixes Coverity bug #647.
>
>
> Signed-off-by: Jesper Juhl <[email protected]>

Acked-by: Markus Rechberger <[email protected]>

thanks,
Markus

> ---
>
> drivers/media/video/em28xx/em28xx-video.c | 1 +
> 1 files changed, 1 insertions(+), 0 deletions(-)
>
> diff --git a/drivers/media/video/em28xx/em28xx-video.c
> b/drivers/media/video/em28xx/em28xx-video.c
> index 2c7b158..40307f3 100644
> --- a/drivers/media/video/em28xx/em28xx-video.c
> +++ b/drivers/media/video/em28xx/em28xx-video.c
> @@ -1772,6 +1772,7 @@ static int em28xx_usb_probe(struct usb_interface
> *interface,
> if (dev->alt_max_pkt_size == NULL) {
> em28xx_errdev("out of memory!\n");
> em28xx_devused&=~(1<<nr);
> + kfree(dev);
> return -ENOMEM;
> }
>
>
>
>
>


--
Markus Rechberger