USB: WUSBCORE: fix leak of urb in wa_xfer_destroy.

The check to free the URB was the opposite of the correct case.  This
patch removes the check altogether since the ptr will be NULL if the URB
was not allocated.  Also use usb_free_urb instead of usb_put_urb.

Signed-off-by: Thomas Pugliese <thomas.pugliese@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/usb/wusbcore/wa-xfer.c b/drivers/usb/wusbcore/wa-xfer.c
index 75a2bea62102a08bfab8f57d1848d6d6d984121d..956aab51cbdafc51b054faddb4a2eff11b121d3f 100644 (file)
--- a/drivers/usb/wusbcore/wa-xfer.c
+++ b/drivers/usb/wusbcore/wa-xfer.c
@@ -166,8 +166,8 @@ static inline void wa_xfer_init(struct wa_xfer *xfer)
 /*
  * Destroy a transfer structure
  *
- * Note that the xfer->seg[index] thingies follow the URB life cycle,
- * so we need to put them, not free them.
+ * Note that freeing xfer->seg[cnt]->urb will free the containing
+ * xfer->seg[cnt] memory that was allocated by __wa_xfer_setup_segs.
  */
 static void wa_xfer_destroy(struct kref *_xfer)
 {
@@ -175,9 +175,8 @@ static void wa_xfer_destroy(struct kref *_xfer)
        if (xfer->seg) {
                unsigned cnt;
                for (cnt = 0; cnt < xfer->segs; cnt++) {
-                       if (xfer->is_inbound)
-                               usb_put_urb(xfer->seg[cnt]->dto_urb);
-                       usb_put_urb(&xfer->seg[cnt]->urb);
+                       usb_free_urb(xfer->seg[cnt]->dto_urb);
+                       usb_free_urb(&xfer->seg[cnt]->urb);
                }
        }
        kfree(xfer);