From: Anton Moryakov <ant.v.morya...@gmail.com>

Ensure int_queue is properly destroyed when receiving wrong buffer
by adding error handling path. Fixes memory leak that occurred
when backbuffer validation failed.

Signed-off-by: Anton Moryakov <ant.v.morya...@gmail.com>
---
 drivers/usb/host/ehci-hcd.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
index 7d5519c65a9..765d8b327ee 100644
--- a/drivers/usb/host/ehci-hcd.c
+++ b/drivers/usb/host/ehci-hcd.c
@@ -1557,6 +1557,7 @@ static int _ehci_submit_int_msg(struct usb_device *dev, 
unsigned long pipe,
                debug("got wrong buffer back (%p instead of %p)\n",
                      backbuffer, buffer);
                return -EINVAL;
+               goto err;
        }
 
        ret = _ehci_destroy_int_queue(dev, queue);
@@ -1565,6 +1566,10 @@ static int _ehci_submit_int_msg(struct usb_device *dev, 
unsigned long pipe,
 
        /* everything worked out fine */
        return result;
+       
+err:
+    _ehci_destroy_int_queue(dev, queue);  // Освобождаем очередь перед выходом
+    return result;
 }
 
 static int _ehci_lock_async(struct ehci_ctrl *ctrl, int lock)
-- 
2.30.2

Reply via email to