Return-Path: MIME-Version: 1.0 In-Reply-To: <1307827296-21363-1-git-send-email-cmdkhh@gmail.com> References: <1307827296-21363-1-git-send-email-cmdkhh@gmail.com> Date: Sat, 11 Jun 2011 14:26:01 -0700 Message-ID: Subject: Re: [PATCH] drivers/bluetooth/bpa10x.c: missing kfrees From: Connor Hansen To: marcel@holtmann.org Cc: padovan@profusion.mobi, linux-bluetooth@vger.kernel.org, linux-kernel@vger.kernel.org, Connor Hansen Content-Type: multipart/alternative; boundary=90e6ba6e8ed63a76af04a576559b List-ID: --90e6ba6e8ed63a76af04a576559b Content-Type: text/plain; charset=ISO-8859-1 sorry this contains an error, I will redo the patch On Sat, Jun 11, 2011 at 2:21 PM, Connor Hansen wrote: > both bpa10x_submit_initr_urb() and bpa10x_submit_bulk_urb() > malloc a char buffer(buf) for usb_fill_init_usb() but fail to > free it after freeing the urb. > > Likewise, bpa10x_send_frame() allocates a usb_ctrlrequest(dr) > for sending packets but does not free it after the > usb_fill_control_urb() call. > > Signed-off-by: Connor Hansen > --- > drivers/bluetooth/bpa10x.c | 3 +++ > 1 files changed, 3 insertions(+), 0 deletions(-) > > diff --git a/drivers/bluetooth/bpa10x.c b/drivers/bluetooth/bpa10x.c > index 751b338..7dfd9ca 100644 > --- a/drivers/bluetooth/bpa10x.c > +++ b/drivers/bluetooth/bpa10x.c > @@ -254,6 +254,7 @@ static inline int bpa10x_submit_intr_urb(struct hci_dev *hdev) > } > > usb_free_urb(urb); > + kfree(buf); > > return err; > } > @@ -295,6 +296,7 @@ static inline int bpa10x_submit_bulk_urb(struct hci_dev *hdev) > } > > usb_free_urb(urb); > + kfree(buf); > > return err; > } > @@ -393,6 +395,7 @@ static int bpa10x_send_frame(struct sk_buff *skb) > skb->data, skb->len, bpa10x_tx_complete, skb); > > hdev->stat.cmd_tx++; > + kfree(df); > break; > > case HCI_ACLDATA_PKT: > -- > 1.7.4.4 > > --90e6ba6e8ed63a76af04a576559b Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable sorry this contains an error, I will redo the patch

On Sat, Jun 11, = 2011 at 2:21 PM, Connor Hansen <cmdk= hh@gmail.com> wrote:
> both bpa10x_submit_initr_urb() and bpa1= 0x_submit_bulk_urb()
> malloc a char buffer(buf) for usb_fill_init_usb() but fail to
> = free it after freeing the urb.
>
> Likewise, bpa10x_send_frame(= ) allocates a usb_ctrlrequest(dr)
> for sending packets but does not = free it after the
> usb_fill_control_urb() call.
>
> Signed-off-by: Connor Han= sen <cmdkhh@gmail.com>
>= ; ---
> =A0drivers/bluetooth/bpa10x.c | =A0 =A03 +++
> =A01 fil= es changed, 3 insertions(+), 0 deletions(-)
>
> diff --git a/drivers/bluetooth/bpa10x.c b/drivers/bluetooth/bp= a10x.c
> index 751b338..7dfd9ca 100644
> --- a/drivers/bluetoot= h/bpa10x.c
> +++ b/drivers/bluetooth/bpa10x.c
> @@ -254,6 +254,= 7 @@ static inline int bpa10x_submit_intr_urb(struct hci_dev *hdev)
> =A0 =A0 =A0 =A0}
>
> =A0 =A0 =A0 =A0usb_free_urb(urb);
= > + =A0 =A0 =A0 kfree(buf);
>
> =A0 =A0 =A0 =A0return err;> =A0}
> @@ -295,6 +296,7 @@ static inline int bpa10x_submit_bul= k_urb(struct hci_dev *hdev)
> =A0 =A0 =A0 =A0}
>
> =A0 =A0 =A0 =A0usb_free_urb(urb);
= > + =A0 =A0 =A0 kfree(buf);
>
> =A0 =A0 =A0 =A0return err;> =A0}
> @@ -393,6 +395,7 @@ static int bpa10x_send_frame(struct= sk_buff *skb)
> =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0 = =A0 =A0 =A0skb->data, skb->len, bpa10x_tx_complete, skb);
>
> =A0 =A0 =A0 =A0 =A0 =A0 =A0 =A0hdev->stat.cmd_tx++;
>= + =A0 =A0 =A0 =A0 =A0 =A0 =A0 kfree(df);
> =A0 =A0 =A0 =A0 =A0 =A0 = =A0 =A0break;
>
> =A0 =A0 =A0 =A0case HCI_ACLDATA_PKT:
> = --
> 1.7.4.4
>
>

--90e6ba6e8ed63a76af04a576559b--