Re: [PATCH] staging: rtl8192u: fix multiple memory leaks on error path

[Navid Emamdoost]

Could you take a look at this patch and confirm it, please?

On Thu, Sep 19, 2019 at 9:51 PM Navid Emamdoost
<navid.emamdoost@xxxxxxxxx> wrote:
>
> In rtl8192_tx on error handling path allocated urbs and also skb should
> be released.
>
> Signed-off-by: Navid Emamdoost <navid.emamdoost@xxxxxxxxx>
> ---
>  drivers/staging/rtl8192u/r8192U_core.c | 17 ++++++++++++-----
>  1 file changed, 12 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/staging/rtl8192u/r8192U_core.c b/drivers/staging/rtl8192u/r8192U_core.c
> index fe1f279ca368..b62b03802b1b 100644
> --- a/drivers/staging/rtl8192u/r8192U_core.c
> +++ b/drivers/staging/rtl8192u/r8192U_core.c
> @@ -1422,7 +1422,7 @@ short rtl8192_tx(struct net_device *dev, struct sk_buff *skb)
>                 (struct tx_fwinfo_819x_usb *)(skb->data + USB_HWDESC_HEADER_LEN);
>         struct usb_device *udev = priv->udev;
>         int pend;
> -       int status;
> +       int status, rt = -1;
>         struct urb *tx_urb = NULL, *tx_urb_zero = NULL;
>         unsigned int idx_pipe;
>
> @@ -1566,8 +1566,10 @@ short rtl8192_tx(struct net_device *dev, struct sk_buff *skb)
>                 }
>                 if (bSend0Byte) {
>                         tx_urb_zero = usb_alloc_urb(0, GFP_ATOMIC);
> -                       if (!tx_urb_zero)
> -                               return -ENOMEM;
> +                       if (!tx_urb_zero) {
> +                               rt = -ENOMEM;
> +                               goto error;
> +                       }
>                         usb_fill_bulk_urb(tx_urb_zero, udev,
>                                           usb_sndbulkpipe(udev, idx_pipe),
>                                           &zero, 0, tx_zero_isr, dev);
> @@ -1577,7 +1579,7 @@ short rtl8192_tx(struct net_device *dev, struct sk_buff *skb)
>                                          "Error TX URB for zero byte %d, error %d",
>                                          atomic_read(&priv->tx_pending[tcb_desc->queue_index]),
>                                          status);
> -                               return -1;
> +                               goto error;
>                         }
>                 }
>                 netif_trans_update(dev);
> @@ -1588,7 +1590,12 @@ short rtl8192_tx(struct net_device *dev, struct sk_buff *skb)
>         RT_TRACE(COMP_ERR, "Error TX URB %d, error %d",
>                  atomic_read(&priv->tx_pending[tcb_desc->queue_index]),
>                  status);
> -       return -1;
> +
> +error:
> +       dev_kfree_skb_any(skb);
> +       usb_free_urb(tx_urb);
> +       usb_free_urb(tx_urb_zero);
> +       return rt;
>  }
>
>  static short rtl8192_usb_initendpoints(struct net_device *dev)
> --
> 2.17.1
>


-- 
Navid.