2017-03-18 00:01:04

by Alexey Khoroshilov

Subject: [PATCH] usbtmc: don't return zero on failure path in usbtmc_probe()

usbtmc_probe() returns zero in case of allocation failures.

The patch fixes that. By the way it rearranges error lables just to improve
readability of quite complex dependencies in error handling code.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Alexey Khoroshilov <[email protected]>
---
drivers/usb/class/usbtmc.c | 22 ++++++++++++++--------
1 file changed, 14 insertions(+), 8 deletions(-)

diff --git a/drivers/usb/class/usbtmc.c b/drivers/usb/class/usbtmc.c
index f03692ec5520..38fc3fd3727e 100644
--- a/drivers/usb/class/usbtmc.c
+++ b/drivers/usb/class/usbtmc.c
@@ -1469,8 +1469,10 @@ static int usbtmc_probe(struct usb_interface *intf,
if (data->iin_ep_present) {
/* allocate int urb */
data->iin_urb = usb_alloc_urb(0, GFP_KERNEL);
- if (!data->iin_urb)
- goto error_register;
+ if (!data->iin_urb) {
+ retcode = -ENOMEM;
+ goto err_alloc_urb;
+ }

/* Protect interrupt in endpoint data until iin_urb is freed */
kref_get(&data->kref);
@@ -1478,8 +1480,10 @@ static int usbtmc_probe(struct usb_interface *intf,
/* allocate buffer for interrupt in */
data->iin_buffer = kmalloc(data->iin_wMaxPacketSize,
GFP_KERNEL);
- if (!data->iin_buffer)
- goto error_register;
+ if (!data->iin_buffer) {
+ retcode = -ENOMEM;
+ goto err_data;
+ }

/* fill interrupt urb */
usb_fill_int_urb(data->iin_urb, data->usb_dev,
@@ -1491,7 +1495,7 @@ static int usbtmc_probe(struct usb_interface *intf,
retcode = usb_submit_urb(data->iin_urb, GFP_KERNEL);
if (retcode) {
dev_err(&intf->dev, "Failed to submit iin_urb\n");
- goto error_register;
+ goto err_data;
}
}

@@ -1502,16 +1506,18 @@ static int usbtmc_probe(struct usb_interface *intf,
dev_err(&intf->dev, "Not able to get a minor"
" (base %u, slice default): %d\n", USBTMC_MINOR_BASE,
retcode);
- goto error_register;
+ goto err_register;
}
dev_dbg(&intf->dev, "Using minor number %d\n", intf->minor);

return 0;

-error_register:
- sysfs_remove_group(&intf->dev.kobj, &capability_attr_grp);
+err_register:
sysfs_remove_group(&intf->dev.kobj, &data_attr_grp);
+err_data:
usbtmc_free_int(data);
+err_alloc_urb:
+ sysfs_remove_group(&intf->dev.kobj, &capability_attr_grp);
kref_put(&data->kref, usbtmc_delete);
return retcode;
}
--
2.7.4

2017-03-18 09:07:10

by Johan Hovold

Subject: Re: [PATCH] usbtmc: don't return zero on failure path in usbtmc_probe()

On Sat, Mar 18, 2017 at 02:38:00AM +0300, Alexey Khoroshilov wrote:
> usbtmc_probe() returns zero in case of allocation failures.
>
> The patch fixes that. By the way it rearranges error lables just to improve
> readability of quite complex dependencies in error handling code.

This was in fact fixed earlier this week by commit 2e47c53503eb ("USB:
usbtmc: fix probe error path") in Greg's usb-linus branch.

The current error label is indeed confusingly named, but that can be
addressed by a follow-on clean-up patch. Note that naming error labels
after what they do (e.g. err_remove_capability) is generally preferred.

Thanks,
Johan