usb: xhci: Fix memory leak when xhci_disable_slot() returns error (11ec7588) · Commits · 戴 / test

If xhci_disable_slot() returns success, a disable slot command trb was queued in the command ring. The command completion handler will free the virtual device data structure associated with the slot. On the other hand, when xhci_disable_slot() returns error, the invokers should take the responsibilities to free the slot related data structure. Otherwise, memory leakage happens. Signed-off-by:

Lu Baolu <baolu.lu@linux.intel.com> Signed-off-by:

Mathias Nyman <mathias.nyman@linux.intel.com> Signed-off-by:

Greg Kroah-Hartman <gregkh@linuxfoundation.org>

drivers/usb/host/xhci.c

+8 −6

Original line number	Diff line number	Diff line
		@@ -3561,11 +3561,9 @@ static void xhci_free_dev(struct usb_hcd hcd, struct usb_device udev)
		del_timer_sync(&virt_dev->eps[i].stop_cmd_timer);
		}

		xhci_disable_slot(xhci, udev->slot_id);
		/*
		* Event command completion handler will free any data structures
		* associated with the slot. XXX Can free sleep?
		*/
		ret = xhci_disable_slot(xhci, udev->slot_id);
		if (ret)
		xhci_free_virt_device(xhci, udev->slot_id);
		}

		int xhci_disable_slot(struct xhci_hcd *xhci, u32 slot_id)
		@@ -3713,7 +3711,11 @@ int xhci_alloc_dev(struct usb_hcd hcd, struct usb_device udev)
		return 1;

		disable_slot:
		return xhci_disable_slot(xhci, udev->slot_id);
		ret = xhci_disable_slot(xhci, udev->slot_id);
		if (ret)
		xhci_free_virt_device(xhci, udev->slot_id);

		return 0;
		}

		/*

Admin message