From 124ef389256f71042ab5dedde98dee5e9999a635 Mon Sep 17 00:00:00 2001 From: Yongsul Oh Date: Tue, 20 Mar 2012 10:38:38 +0900 Subject: [PATCH] usb: gadget: composite: prevent a memory leak when configuration bind fails In some USB composite gadget drivers, the configuration's bind function called by the usb_add_config() calls multiple bind config functions. (for example cdc2 configuration bind function in the cdc_do_config() of the cdc2.c has two functionality bind config functions. - the ecm_bind_config() & the acm_bind_config()) In each functionality bind config function, new instance is allocated and finally added by the usb_add_function(). So if an error occurred during the second functionality bind config (for example an error occurred at the acm_bind_config() after succeeding of the ecm_bind_function()), the instance created by the acm_bind_config() cannot be freed creating a memory leak. This patch fixes this issue. Signed-off-by: Yongsul Oh Acked-by: Michal Nazarewicz Signed-off-by: Felipe Balbi --- drivers/usb/gadget/composite.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c index baaebf2830f..4cb1801539a 100644 --- a/drivers/usb/gadget/composite.c +++ b/drivers/usb/gadget/composite.c @@ -737,6 +737,19 @@ int usb_add_config(struct usb_composite_dev *cdev, status = bind(config); if (status < 0) { + while (!list_empty(&config->functions)) { + struct usb_function *f; + + f = list_first_entry(&config->functions, + struct usb_function, list); + list_del(&f->list); + if (f->unbind) { + DBG(cdev, "unbind function '%s'/%p\n", + f->name, f); + f->unbind(config, f); + /* may free memory for "f" */ + } + } list_del(&config->list); config->cdev = NULL; } else { -- 2.41.0