Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752382AbdHOVjm (ORCPT ); Tue, 15 Aug 2017 17:39:42 -0400 Received: from mail.ispras.ru ([83.149.199.45]:44882 "EHLO mail.ispras.ru" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751068AbdHOVjl (ORCPT ); Tue, 15 Aug 2017 17:39:41 -0400 From: Alexey Khoroshilov To: Felipe Balbi , Greg Kroah-Hartman Cc: Alexey Khoroshilov , Krzysztof Opasiak , Anton Vasilyev , linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org, ldv-project@linuxtesting.org Subject: Inconsistency in usb_add_gadget_udc_release() interface Date: Wed, 16 Aug 2017 00:39:27 +0300 Message-Id: <1502833167-19354-1-git-send-email-khoroshilov@ispras.ru> X-Mailer: git-send-email 2.7.4 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 688 Lines: 22 Hello, usb_add_gadget_udc_release() gets release() argument that allows to release user resources. As far as I can see, the release() is called on error paths of usb_add_gadget_udc_release() as a result of put_device(&gadget->dev); except for the only path going via err1. As a result a caller of the usb_add_gadget_udc_release() have no chance to know if the release() was invoked or not. It may lead to memory leaks (drivers/usb/gadget/udc/snps_udc_core.c) or to double free (drivers/usb/gadget/udc/fsl_udc_core.c). Is my reading correct? If so, should we always call release() on error paths? -- Alexey Khoroshilov Linux Verification Center, ISPRAS web: http://linuxtesting.org