From 79731cbd783d3693d4b84731e3cfc79b9f828170 Mon Sep 17 00:00:00 2001 From: Thomas Pugliese Date: Thu, 15 Aug 2013 14:37:42 -0500 Subject: [PATCH] USB: WUSBCORE: fix leak of urb in wa_xfer_destroy. The check to free the URB was the opposite of the correct case. This patch removes the check altogether since the ptr will be NULL if the URB was not allocated. Also use usb_free_urb instead of usb_put_urb. Signed-off-by: Thomas Pugliese Signed-off-by: Greg Kroah-Hartman --- drivers/usb/wusbcore/wa-xfer.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/drivers/usb/wusbcore/wa-xfer.c b/drivers/usb/wusbcore/wa-xfer.c index 75a2bea62102..956aab51cbda 100644 --- a/drivers/usb/wusbcore/wa-xfer.c +++ b/drivers/usb/wusbcore/wa-xfer.c @@ -166,8 +166,8 @@ static inline void wa_xfer_init(struct wa_xfer *xfer) /* * Destroy a transfer structure * - * Note that the xfer->seg[index] thingies follow the URB life cycle, - * so we need to put them, not free them. + * Note that freeing xfer->seg[cnt]->urb will free the containing + * xfer->seg[cnt] memory that was allocated by __wa_xfer_setup_segs. */ static void wa_xfer_destroy(struct kref *_xfer) { @@ -175,9 +175,8 @@ static void wa_xfer_destroy(struct kref *_xfer) if (xfer->seg) { unsigned cnt; for (cnt = 0; cnt < xfer->segs; cnt++) { - if (xfer->is_inbound) - usb_put_urb(xfer->seg[cnt]->dto_urb); - usb_put_urb(&xfer->seg[cnt]->urb); + usb_free_urb(xfer->seg[cnt]->dto_urb); + usb_free_urb(&xfer->seg[cnt]->urb); } } kfree(xfer); -- 2.30.2