From: Anton Moryakov <ant.v.morya...@gmail.com> Ensure int_queue is properly destroyed when receiving wrong buffer by adding error handling path. Fixes memory leak that occurred when backbuffer validation failed.
Signed-off-by: Anton Moryakov <ant.v.morya...@gmail.com> --- drivers/usb/host/ehci-hcd.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c index 7d5519c65a9..765d8b327ee 100644 --- a/drivers/usb/host/ehci-hcd.c +++ b/drivers/usb/host/ehci-hcd.c @@ -1557,6 +1557,7 @@ static int _ehci_submit_int_msg(struct usb_device *dev, unsigned long pipe, debug("got wrong buffer back (%p instead of %p)\n", backbuffer, buffer); result = -EINVAL; + goto err; } ret = _ehci_destroy_int_queue(dev, queue); @@ -1565,6 +1566,10 @@ static int _ehci_submit_int_msg(struct usb_device *dev, unsigned long pipe, /* everything worked out fine */ return result; + +err: + _ehci_destroy_int_queue(dev, queue); // Освобождаем очередь перед выходом + return result; } static int _ehci_lock_async(struct ehci_ctrl *ctrl, int lock) -- 2.30.2