From caa6c4b6bdab699234e56cbb607bb82406f94ad8 Mon Sep 17 00:00:00 2001 From: Pratham Pratap Date: Tue, 22 Sep 2020 20:11:50 +0530 Subject: [PATCH] usb: f_fs: Fix memory leak if copy_from_iter_full fails Consider a case where copy_from_iter_full fails and it leads the driver to free the buffer which is allocated for io_data but in ffs_free_buffer function, driver checks for io_data->buf, which is NULL in this case, and it returns without freeing the buffer causing memory leak. Fix this by assigning data to io_data->buf right after memory allocation for io_data is successful. Change-Id: I20719fdeed603b74fe05215ec057d4cc22379ab2 Signed-off-by: Pratham Pratap --- drivers/usb/gadget/function/f_fs.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c index 511125a2d3b3..42142a25df45 100644 --- a/drivers/usb/gadget/function/f_fs.c +++ b/drivers/usb/gadget/function/f_fs.c @@ -1106,6 +1106,7 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data) ret = -ENOMEM; goto error_mutex; } + io_data->buf = data; if (!io_data->read && !copy_from_iter_full(data, data_len, &io_data->data)) { ret = -EFAULT; @@ -1151,8 +1152,6 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data) } req->length = data_len; - io_data->buf = data; - req->context = &done; req->complete = ffs_epfile_io_complete; @@ -1200,7 +1199,6 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data) } req->length = data_len; - io_data->buf = data; io_data->ep = ep->ep; io_data->req = req; io_data->ffs = epfile->ffs;