Re: [RFC PATCH v2] Bluetooth: btusb: Fix memory leak in play_deferred

[Oliver Neukum]

Am Dienstag, den 18.07.2017, 08:44 +0200 schrieb Marcel Holtmann:
> > diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
> > index 0d533b2..a22a08b 100644
> > --- a/drivers/bluetooth/btusb.c
> > +++ b/drivers/bluetooth/btusb.c
> > @@ -3260,19 +3260,33 @@ static int btusb_suspend(struct usb_interface *intf, pm_message_t message)
> >ÂÂÂÂÂÂÂreturn 0;
> > }
> > 
> > +static void btusb_deferred_tx_complete(struct urb *urb)
> > +{
> > +ÂÂÂÂÂbtusb_tx_complete(urb);
> > +ÂÂÂÂÂusb_free_urb(urb);
> > +}
> > +
> > static void play_deferred(struct btusb_data *data)
> > {
> >ÂÂÂÂÂÂÂstruct urb *urb;
> >ÂÂÂÂÂÂÂint err;
> > 
> >ÂÂÂÂÂÂÂwhile ((urb = usb_get_from_anchor(&data->deferred))) {
> > +ÂÂÂÂÂÂÂÂÂÂÂÂÂ/* Add a hook to free urb after completed */
> > +ÂÂÂÂÂÂÂÂÂÂÂÂÂurb->complete = btusb_deferred_tx_complete;
> > +
> >ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂerr = usb_submit_urb(urb, GFP_ATOMIC);
> > -ÂÂÂÂÂÂÂÂÂÂÂÂÂif (err < 0)
> > -ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂbreak;
> > +ÂÂÂÂÂÂÂÂÂÂÂÂÂif (err < 0) {
> > +ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂif (err != -EPERM && err != -ENODEV)
> > +ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂBT_ERR("%s urb %p submission failed (%d)",
> > +ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂ data->hdev->name, urb, -err);
> > +ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂkfree(urb->setup_packet);
> > +ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂusb_free_urb(urb);
> > +ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂcontinue;
> > +ÂÂÂÂÂÂÂÂÂÂÂÂÂ}
> > 
> >ÂÂÂÂÂÂÂÂÂÂÂÂÂÂÂdata->tx_in_flight++;
> >ÂÂÂÂÂÂÂ}
> > -ÂÂÂÂÂusb_scuttle_anchored_urbs(&data->deferred);
> > }
> 
> can I get an ack from you on this one?

Hi,

I am afraid not. We cannot silently drop one part of a transmission.
I am afraid that the correct algorithm, if we encounter an error at
that stage, is to abort the operation and report an error.

	Regards
		Oliver