[PATCH 4.4 36/75] USB: serial: io_edgeport: fix memory leak in edge_startup

[gregkh]

From: Greg Kroah-Hartman <gre...@linuxfoundation.org>

From: Pavel Skripkin <paskrip...@gmail.com>

commit cfdc67acc785e01a8719eeb7012709d245564701 upstream.

sysbot found memory leak in edge_startup().
The problem was that when an error was received from the usb_submit_urb(),
nothing was cleaned up.

Reported-by: syzbot+59f777bdcbdd7eea5...@syzkaller.appspotmail.com
Signed-off-by: Pavel Skripkin <paskrip...@gmail.com>
Fixes: 6e8cf7751f9f ("USB: add EPIC support to the io_edgeport driver")
Cc: sta...@vger.kernel.org      # 2.6.21: c5c0c55598ce
Signed-off-by: Johan Hovold <jo...@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>
---
 drivers/usb/serial/io_edgeport.c |   26 ++++++++++++++++----------
 1 file changed, 16 insertions(+), 10 deletions(-)

--- a/drivers/usb/serial/io_edgeport.c
+++ b/drivers/usb/serial/io_edgeport.c
@@ -2966,26 +2966,32 @@ static int edge_startup(struct usb_seria
                                response = -ENODEV;
                        }
 
-                       usb_free_urb(edge_serial->interrupt_read_urb);
-                       kfree(edge_serial->interrupt_in_buffer);
-
-                       usb_free_urb(edge_serial->read_urb);
-                       kfree(edge_serial->bulk_in_buffer);
-
-                       kfree(edge_serial);
-
-                       return response;
+                       goto error;
                }
 
                /* start interrupt read for this edgeport this interrupt will
                 * continue as long as the edgeport is connected */
                response = usb_submit_urb(edge_serial->interrupt_read_urb,
                                                                GFP_KERNEL);
-               if (response)
+               if (response) {
                        dev_err(ddev, "%s - Error %d submitting control urb\n",
                                __func__, response);
+
+                       goto error;
+               }
        }
        return response;
+
+error:
+       usb_free_urb(edge_serial->interrupt_read_urb);
+       kfree(edge_serial->interrupt_in_buffer);
+
+       usb_free_urb(edge_serial->read_urb);
+       kfree(edge_serial->bulk_in_buffer);
+
+       kfree(edge_serial);
+
+       return response;
 }