Received: by 2002:a05:6a10:1287:0:0:0:0 with SMTP id d7csp508252pxv; Thu, 15 Jul 2021 09:08:04 -0700 (PDT) X-Google-Smtp-Source: ABdhPJyWY02mItsGR/2wE2erFPgR1TKPeg1qXRNcMMt+ZrG6vja6hGWvImOiYmfEhsX/J4gC/djp X-Received: by 2002:a92:7305:: with SMTP id o5mr3135481ilc.198.1626365284107; Thu, 15 Jul 2021 09:08:04 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1626365284; cv=none; d=google.com; s=arc-20160816; b=UST8QSU8upNOoKPQekdp4YyXW2DBlvmHhkGR2W0/zO7vtDIXFY7iosuCII2vrfeGQY aHIyBVurzrLpZ9vH0g+vYLlm3PeaiWIc2YkhWMDgM7yPEtG90DS4WUF3sC+IWLLz6AAe Sk9VxGE4P0NbiNsBAEKFTu3Fpb4FsnjJYfWMKtdLOXjm+zycgX+3PjiiqQEsuotceqDk x1x2yJnY5vN28fdLw6wEVzJeR4ke/tMwGhjws660F4x6zISmk5m0xSukwdBpDmz5jarh 2D+LEJ+GDDAeiIymFsdWSd5AFnDgOE554sQBp269sdpBJXe9yY2XUU3/DaF/ENsAcpD0 tFDA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:content-language :in-reply-to:mime-version:user-agent:date:message-id:organization :from:references:cc:to:subject:dkim-signature; bh=ET8KK4SOb9vnfeTyovtTPGkeJsSQPc5xW8yBdcvUHQ4=; b=cZalZlxbqkzJ+56oCsMaI2EZhGByDmbMrx0qT1JUaaubQbzQ5VlIdkFv2v7cb45zPC cp3ruPz9AC+2moFjMaECMyJxq9Wt7jiqFfbwxWX3ej1j6WgF1AUebnlqSZ0GbWlPmoXK 89xEEbuyV2rLZR4JP+4yLAGBbba/E+z2CVycXVTaAofNf2B0JKn30SaTGBlv17+jXLOc 7G3tXXwRyJgaLtjSsmipRe5fcKwhXRNdm/hAQrzdF8c2U4gCuvYMFgbWelc5KSiPB6yO dU2WHXuVWRtpT0CejZr/DA1gRpqyW+NUJR/JmtAE6dtjzkG7Qdeao+HvCRwYKhd+ddZ2 1akQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@mev.co.uk header.s=20190130-41we5z8j header.b=M23+6fH0; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id r17si7523863iov.104.2021.07.15.09.07.50; Thu, 15 Jul 2021 09:08:04 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@mev.co.uk header.s=20190130-41we5z8j header.b=M23+6fH0; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229617AbhGOLoj (ORCPT + 99 others); Thu, 15 Jul 2021 07:44:39 -0400 Received: from smtp88.ord1d.emailsrvr.com ([184.106.54.88]:34084 "EHLO smtp88.ord1d.emailsrvr.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229553AbhGOLoj (ORCPT ); Thu, 15 Jul 2021 07:44:39 -0400 X-Greylist: delayed 439 seconds by postgrey-1.27 at vger.kernel.org; Thu, 15 Jul 2021 07:44:39 EDT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=mev.co.uk; s=20190130-41we5z8j; t=1626348867; bh=3cztsMwQmMdPTT+daePLLQcpJuknVNxL+D3iQl4SaG4=; h=Subject:To:From:Date:From; b=M23+6fH0emXzo+TwwyfxUhEVkN/Kj1IdT8u2+VxSvBs848IzUunlMrq/RuQrkJLM3 c8U9tmaIuvy4Ev6FwvuCHo5Gk8g2BIE37U5fahPJfKMoIQndKRyQmGP7g1KvY5pbW4 +lS/zkKVnc+9u5fvtZBwVartlKxvRAMGBfaU6gNo= X-Auth-ID: abbotti@mev.co.uk Received: by smtp20.relay.ord1d.emailsrvr.com (Authenticated sender: abbotti-AT-mev.co.uk) with ESMTPSA id D6A7BC00AA; Thu, 15 Jul 2021 07:34:26 -0400 (EDT) Subject: Re: [PATCH] comedi: usbdux: free allocated memory/urbs on failure To: Salah Triki , hsweeten@visionengravers.com, gregkh@linuxfoundation.org Cc: linux-kernel@vger.kernel.org References: <20210715022652.GA2054080@pc> From: Ian Abbott Organization: MEV Ltd. Message-ID: <5f688e04-80cc-e37b-3f6f-3360b5af89aa@mev.co.uk> Date: Thu, 15 Jul 2021 12:34:25 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Thunderbird/78.11.0 MIME-Version: 1.0 In-Reply-To: <20210715022652.GA2054080@pc> Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-GB Content-Transfer-Encoding: 7bit X-Classification-ID: a242d17c-20e9-4b90-ba75-3c0943789a6f-1-1 Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 15/07/2021 03:26, Salah Triki wrote: > Free allocated memory/urbs on failure in order to prevent memory leaks. > > Signed-off-by: Salah Triki > --- > drivers/comedi/drivers/usbdux.c | 42 ++++++++++++++++++++++++++++----- > 1 file changed, 36 insertions(+), 6 deletions(-) > > diff --git a/drivers/comedi/drivers/usbdux.c b/drivers/comedi/drivers/usbdux.c > index 0350f303d557..fe388a9a588a 100644 > --- a/drivers/comedi/drivers/usbdux.c > +++ b/drivers/comedi/drivers/usbdux.c > @@ -1456,7 +1456,7 @@ static int usbdux_alloc_usb_buffers(struct comedi_device *dev) > /* one frame: 1ms */ > urb = usb_alloc_urb(1, GFP_KERNEL); > if (!urb) > - return -ENOMEM; > + goto free_ai_urbs1; > devpriv->ai_urbs[i] = urb; > > urb->dev = usb; > @@ -1465,7 +1465,7 @@ static int usbdux_alloc_usb_buffers(struct comedi_device *dev) > urb->transfer_flags = URB_ISO_ASAP; > urb->transfer_buffer = kzalloc(SIZEINBUF, GFP_KERNEL); > if (!urb->transfer_buffer) > - return -ENOMEM; > + goto free_ai_urbs2; > > urb->complete = usbduxsub_ai_isoc_irq; > urb->number_of_packets = 1; > @@ -1478,7 +1478,7 @@ static int usbdux_alloc_usb_buffers(struct comedi_device *dev) > /* one frame: 1ms */ > urb = usb_alloc_urb(1, GFP_KERNEL); > if (!urb) > - return -ENOMEM; > + goto free_ao_urbs1; > devpriv->ao_urbs[i] = urb; > > urb->dev = usb; > @@ -1487,7 +1487,7 @@ static int usbdux_alloc_usb_buffers(struct comedi_device *dev) > urb->transfer_flags = URB_ISO_ASAP; > urb->transfer_buffer = kzalloc(SIZEOUTBUF, GFP_KERNEL); > if (!urb->transfer_buffer) > - return -ENOMEM; > + goto free_ao_urbs2; > > urb->complete = usbduxsub_ao_isoc_irq; > urb->number_of_packets = 1; > @@ -1504,17 +1504,47 @@ static int usbdux_alloc_usb_buffers(struct comedi_device *dev) > if (devpriv->pwm_buf_sz) { > urb = usb_alloc_urb(0, GFP_KERNEL); > if (!urb) > - return -ENOMEM; > + goto free_ao_urbs0; > devpriv->pwm_urb = urb; > > /* max bulk ep size in high speed */ > urb->transfer_buffer = kzalloc(devpriv->pwm_buf_sz, > GFP_KERNEL); > if (!urb->transfer_buffer) > - return -ENOMEM; > + goto free_urb; > } > > return 0; > + > +free_urb: > + usb_free_urb(urb); > + > +free_ao_urbs0: > + i = devpriv->n_ao_urbs; > + > +free_ao_urbs1: > + i--; > + > +free_ao_urbs2: > + while (i >= 0) { > + kfree(devpriv->ao_urbs[i]->transfer_buffer); > + usb_free_urb(devpriv->ao_urbs[i]); > + i--; > + } > + i = devpriv->n_ai_urbs; > + > +free_ai_urbs1: > + i--; > + > +free_ai_urbs2: > + while (i >= 0) { > + kfree(devpriv->ai_urbs[i]->transfer_buffer); > + usb_free_urb(devpriv->ai_urbs[i]); > + i--; > + } > + > + return -ENOMEM; > + > } > > static void usbdux_free_usb_buffers(struct comedi_device *dev) > NAK. Actually, there is no need for this because usbdux_free_usb_buffers() will soon be called to clean up when this fails.[*] Also, it isn't cleaning up enough to prevent double frees when usbdux_free_usb_buffers() is called later. [*] The error returned from usbdux_alloc_usb_buffers() is propagated as an error returned by usbdux_auto_attach(). The Comedi core calls the "detach()" handler (usbdux_detach()) to clean up when the "auto_attach()" handler (usbdux_auto_attach()) returns an error. usbdux_detach() calls usbdux_free_usb_buffers() to clean up the (possibly partial) allocations done by usbdux_alloc_usb_buffers(). -- -=( Ian Abbott || MEV Ltd. is a company )=- -=( registered in England & Wales. Regd. number: 02862268. )=- -=( Regd. addr.: S11 & 12 Building 67, Europa Business Park, )=- -=( Bird Hall Lane, STOCKPORT, SK3 0XA, UK. || www.mev.co.uk )=-