From: Thomas Pugliese Date: Thu, 15 Aug 2013 19:37:42 +0000 (-0500) Subject: USB: WUSBCORE: fix leak of urb in wa_xfer_destroy. X-Git-Url: http://git.cdn.openwrt.org/?a=commitdiff_plain;h=79731cbd783d3693d4b84731e3cfc79b9f828170;p=openwrt%2Fstaging%2Fblogic.git USB: WUSBCORE: fix leak of urb in wa_xfer_destroy. The check to free the URB was the opposite of the correct case. This patch removes the check altogether since the ptr will be NULL if the URB was not allocated. Also use usb_free_urb instead of usb_put_urb. Signed-off-by: Thomas Pugliese Signed-off-by: Greg Kroah-Hartman --- diff --git a/drivers/usb/wusbcore/wa-xfer.c b/drivers/usb/wusbcore/wa-xfer.c index 75a2bea62102..956aab51cbda 100644 --- a/drivers/usb/wusbcore/wa-xfer.c +++ b/drivers/usb/wusbcore/wa-xfer.c @@ -166,8 +166,8 @@ static inline void wa_xfer_init(struct wa_xfer *xfer) /* * Destroy a transfer structure * - * Note that the xfer->seg[index] thingies follow the URB life cycle, - * so we need to put them, not free them. + * Note that freeing xfer->seg[cnt]->urb will free the containing + * xfer->seg[cnt] memory that was allocated by __wa_xfer_setup_segs. */ static void wa_xfer_destroy(struct kref *_xfer) { @@ -175,9 +175,8 @@ static void wa_xfer_destroy(struct kref *_xfer) if (xfer->seg) { unsigned cnt; for (cnt = 0; cnt < xfer->segs; cnt++) { - if (xfer->is_inbound) - usb_put_urb(xfer->seg[cnt]->dto_urb); - usb_put_urb(&xfer->seg[cnt]->urb); + usb_free_urb(xfer->seg[cnt]->dto_urb); + usb_free_urb(&xfer->seg[cnt]->urb); } } kfree(xfer);