USB: serial: mos7720: fix mos_parport refcount imbalance on error path [Linux 3.16.72]

This Linux kernel change "USB: serial: mos7720: fix mos_parport refcount imbalance on error path" is included in the Linux 3.16.72 release. This change is authored by Lin Yi <teroincn [at] 163.com> on Wed Mar 20 19:04:56 2019 +0800. The commit for this change in Linux stable tree is 83ffc8b (patch) which is from upstream commit 2908b07. The same Linux upstream change may have been applied to various maintained Linux releases and you can find all Linux releases containing changes from upstream 2908b07.

USB: serial: mos7720: fix mos_parport refcount imbalance on error path

commit 2908b076f5198d231de62713cb2b633a3a4b95ac upstream.

The write_parport_reg_nonblock() helper takes a reference to the struct
mos_parport, but failed to release it in a couple of error paths after
allocation failures, leading to a memory leak.

Johan said that move the kref_get() and mos_parport assignment to the
end of urbtrack initialisation is a better way, so move it. and
mos_parport do not used until urbtrack initialisation.

Signed-off-by: Lin Yi <teroincn@163.com>
Fixes: b69578df7e98 ("USB: usbserial: mos7720: add support for parallel port on moschip 7715")
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>

There are 4 lines of Linux source code added/deleted in this change. Code changes to Linux kernel are as follows.

 drivers/usb/serial/mos7720.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/serial/mos7720.c b/drivers/usb/serial/mos7720.c
index 56c4f6d..454898c 100644
--- a/drivers/usb/serial/mos7720.c
+++ b/drivers/usb/serial/mos7720.c
@@ -362,8 +362,6 @@ static int write_parport_reg_nonblock(struct mos7715_parport *mos_parport,
    if (!urbtrack)
        return -ENOMEM;

-   kref_get(&mos_parport->ref_count);
-   urbtrack->mos_parport = mos_parport;
    urbtrack->urb = usb_alloc_urb(0, GFP_ATOMIC);
    if (!urbtrack->urb) {
        kfree(urbtrack);
@@ -384,6 +382,8 @@ static int write_parport_reg_nonblock(struct mos7715_parport *mos_parport,
                 usb_sndctrlpipe(usbdev, 0),
                 (unsigned char *)urbtrack->setup,
                 NULL, 0, async_complete, urbtrack);
+   kref_get(&mos_parport->ref_count);
+   urbtrack->mos_parport = mos_parport;
    kref_init(&urbtrack->ref_count);
    INIT_LIST_HEAD(&urbtrack->urblist_entry);

Leave a Reply

Your email address will not be published. Required fields are marked *