Received: by 10.223.185.116 with SMTP id b49csp6371907wrg; Wed, 28 Feb 2018 08:19:52 -0800 (PST) X-Google-Smtp-Source: AH8x227Z1Y2Ap7QugatdugHAyBah+q5D7qXrHa0g+TXSRKvbe3vfSddZ8sg0k2lMA9tCK8cx8w1t X-Received: by 2002:a17:902:7046:: with SMTP id h6-v6mr17788506plt.301.1519834792830; Wed, 28 Feb 2018 08:19:52 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1519834792; cv=none; d=google.com; s=arc-20160816; b=PvrrxdlcE1eJPUwwCkgjfdcH3DWh3BVb32WcDCXx261cWeafQMzX6ldf7kZ9Vcmi8y lJNt4EshUSaUdnQtc1QSK1d+zmvD39hQQB/2gPQTcnSm68s7Op7NWEAQrmCFgG5YEl54 M0H2jiU7bSFui/4m4hjf0uweel/txoliLcKOrLoSBYkjFy83YPgpZS6uwivJuWwVSVen S642Gy+iSC0yQrgPNNFG0vMM8HUnY809Z7DQKaenh9o2Fii2YuR86b6LaMppZk0xvC+M DyDPl91drHBTTqA8vVA7i6JLU/4oA3m0LQ3nh87xSXfuPTA70mnhhfh+ibN+H5C/nKOs 2W/g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:in-reply-to:subject:message-id:date:cc:to :from:mime-version:content-transfer-encoding:content-disposition :arc-authentication-results; bh=ADub11FcIHRWuduI8qkMlcM9upfj/qasiGZn5zj0jUo=; b=S4HPpqpLoyjqqgSN7T8CvsMrm6/bZBfU/rhO3JGKheihhXjC7O3piI9w2IAu1YMZG7 CwjH41sqxqXBtcCAjeeG9wG/WkFOth1YXRYSNfj67tni2M/4SB9H79tBSRbhV0SVmLYG yzYr9xPeCJJgaZmMTMkGM3mwE1xWQbArM4mXdCfW6RzezkHRw+2UIHQy6DpzPPaJH/go 3UNesOhZ5au9ff0oRQNiAW66hEl9rlCCdGgs8f1lTLVCIzlKh67eZKAgXuxFukh7HyZT B1+OhjL77XJXXsf/wlrac2hbeKy/Sfdxro/GgRoccp+4zPycczSKDHhHIfDkJBTyepd6 IsSw== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id l19si1190294pgo.629.2018.02.28.08.19.37; Wed, 28 Feb 2018 08:19:52 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S935098AbeB1QSN (ORCPT + 99 others); Wed, 28 Feb 2018 11:18:13 -0500 Received: from shadbolt.e.decadent.org.uk ([88.96.1.126]:35293 "EHLO shadbolt.e.decadent.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S935084AbeB1QSL (ORCPT ); Wed, 28 Feb 2018 11:18:11 -0500 Received: from [2a02:8011:400e:2:6f00:88c8:c921:d332] (helo=deadeye) by shadbolt.decadent.org.uk with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.84_2) (envelope-from ) id 1er3Yq-0006Xm-AA; Wed, 28 Feb 2018 15:22:28 +0000 Received: from ben by deadeye with local (Exim 4.90_1) (envelope-from ) id 1er3Yj-0000F3-CK; Wed, 28 Feb 2018 15:22:21 +0000 Content-Type: text/plain; charset="UTF-8" Content-Disposition: inline Content-Transfer-Encoding: 8bit MIME-Version: 1.0 From: Ben Hutchings To: linux-kernel@vger.kernel.org, stable@vger.kernel.org CC: akpm@linux-foundation.org, "Alan Stern" , "Alexey Khoroshilov" , "Felipe Balbi" Date: Wed, 28 Feb 2018 15:20:18 +0000 Message-ID: X-Mailer: LinuxStableQueue (scripts by bwh) Subject: [PATCH 3.16 192/254] USB: Gadget core: fix inconsistency in the interface tousb_add_gadget_udc_release() In-Reply-To: X-SA-Exim-Connect-IP: 2a02:8011:400e:2:6f00:88c8:c921:d332 X-SA-Exim-Mail-From: ben@decadent.org.uk X-SA-Exim-Scanned: No (on shadbolt.decadent.org.uk); SAEximRunCond expanded to false Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 3.16.55-rc1 review patch. If anyone has any objections, please let me know. ------------------ From: Alan Stern commit afd7fd81f22bf90474216515dbd6088f9bd70343 upstream. The usb_add_gadget_udc_release() routine in the USB gadget core will sometimes but not always call the gadget's release function when an error occurs. More specifically, if the struct usb_udc allocation fails then the release function is not called, and for other errors it is. As a result, users of this routine cannot know whether they need to deallocate the memory containing the gadget structure following an error. This leads to unavoidable memory leaks or double frees. This patch fixes the problem by splitting the existing device_register() call into device_initialize() and device_add(), and doing the udc allocation in between. That way, even if the allocation fails it is still possible to call device_del(), and so the release function will be always called following an error. Signed-off-by: Alan Stern Reported-by: Alexey Khoroshilov Signed-off-by: Felipe Balbi [bwh: Backported to 3.16: adjust filename] Signed-off-by: Ben Hutchings --- drivers/usb/gadget/udc-core.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) --- a/drivers/usb/gadget/udc-core.c +++ b/drivers/usb/gadget/udc-core.c @@ -192,6 +192,7 @@ static void usb_udc_nop_release(struct d * @release: a gadget release function. * * Returns zero on success, negative errno otherwise. + * Calls the gadget release function in the latter case. */ int usb_add_gadget_udc_release(struct device *parent, struct usb_gadget *gadget, void (*release)(struct device *dev)) @@ -199,10 +200,6 @@ int usb_add_gadget_udc_release(struct de struct usb_udc *udc; int ret = -ENOMEM; - udc = kzalloc(sizeof(*udc), GFP_KERNEL); - if (!udc) - goto err1; - dev_set_name(&gadget->dev, "gadget"); INIT_WORK(&gadget->work, usb_gadget_state_work); gadget->dev.parent = parent; @@ -218,7 +215,13 @@ int usb_add_gadget_udc_release(struct de else gadget->dev.release = usb_udc_nop_release; - ret = device_register(&gadget->dev); + device_initialize(&gadget->dev); + + udc = kzalloc(sizeof(*udc), GFP_KERNEL); + if (!udc) + goto err1; + + ret = device_add(&gadget->dev); if (ret) goto err2; @@ -255,10 +258,10 @@ err3: device_del(&gadget->dev); err2: - put_device(&gadget->dev); kfree(udc); err1: + put_device(&gadget->dev); return ret; } EXPORT_SYMBOL_GPL(usb_add_gadget_udc_release);