Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751507AbdISRlT (ORCPT ); Tue, 19 Sep 2017 13:41:19 -0400 Received: from canardo.mork.no ([148.122.252.1]:53263 "EHLO canardo.mork.no" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750973AbdISRlR (ORCPT ); Tue, 19 Sep 2017 13:41:17 -0400 From: =?utf-8?Q?Bj=C3=B8rn_Mork?= To: Douglas Anderson Cc: Oliver Neukum , groeck@chromium.org, grundler@chromium.org, netdev@vger.kernel.org, linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: [RFC PATCH 3/3] usbnet: Fix memory leak when rx_submit() fails Organization: m References: <20170919161522.995-1-dianders@chromium.org> <20170919161522.995-3-dianders@chromium.org> Date: Tue, 19 Sep 2017 19:41:09 +0200 In-Reply-To: <20170919161522.995-3-dianders@chromium.org> (Douglas Anderson's message of "Tue, 19 Sep 2017 09:15:22 -0700") Message-ID: <877ewuoabu.fsf@miraculix.mork.no> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/25.1 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Transfer-Encoding: 8bit X-MIME-Autoconverted: from quoted-printable to 8bit by nfs id v8JHfPAY005875 Content-Length: 533 Lines: 27 Douglas Anderson writes: > If rx_submit() returns an error code then nobody calls usb_free_urb(). > That means it's leaked. Nope. rx_submit() will call usb_free_urb() before returning an error: static int rx_submit (struct usbnet *dev, struct urb *urb, gfp_t flags) .. if (!skb) { netif_dbg(dev, rx_err, dev->net, "no rx skb\n"); usbnet_defer_kevent (dev, EVENT_RX_MEMORY); usb_free_urb (urb); return -ENOMEM; } .. if (retval) { dev_kfree_skb_any (skb); usb_free_urb (urb); } Bjørn