When usb_alloc_urb fails, the lack of error-handling code may cause unexpected results. This patch adds error-handling code after calling usb_alloc_urb. Signed-off-by: Zhouyang Jia <jiazhouyang09@xxxxxxxxx> --- v1->v2: - Fix memory leak. v2->v3: - Release memory in error path. v3->v4: - Use kcalloc instead of kmalloc_array. --- drivers/staging/rtl8192u/r8192U_core.c | 27 +++++++++++++++++---------- 1 file changed, 17 insertions(+), 10 deletions(-) diff --git a/drivers/staging/rtl8192u/r8192U_core.c b/drivers/staging/rtl8192u/r8192U_core.c index 7a0dbc0..d15ee4f 100644 --- a/drivers/staging/rtl8192u/r8192U_core.c +++ b/drivers/staging/rtl8192u/r8192U_core.c @@ -1639,8 +1639,9 @@ short rtl8192_tx(struct net_device *dev, struct sk_buff *skb) static short rtl8192_usb_initendpoints(struct net_device *dev) { struct r8192_priv *priv = ieee80211_priv(dev); + int i; - priv->rx_urb = kmalloc(sizeof(struct urb *) * (MAX_RX_URB + 1), + priv->rx_urb = kcalloc(MAX_RX_URB + 1, sizeof(struct urb *), GFP_KERNEL); if (!priv->rx_urb) return -ENOMEM; @@ -1649,12 +1650,12 @@ static short rtl8192_usb_initendpoints(struct net_device *dev) for (i = 0; i < (MAX_RX_URB + 1); i++) { priv->rx_urb[i] = usb_alloc_urb(0, GFP_KERNEL); if (!priv->rx_urb[i]) - return -ENOMEM; + goto out_release_mem; priv->rx_urb[i]->transfer_buffer = kmalloc(RX_URB_SIZE, GFP_KERNEL); if (!priv->rx_urb[i]->transfer_buffer) - return -ENOMEM; + goto out_release_mem; priv->rx_urb[i]->transfer_buffer_length = RX_URB_SIZE; } @@ -1666,9 +1667,13 @@ static short rtl8192_usb_initendpoints(struct net_device *dev) void *oldaddr, *newaddr; priv->rx_urb[16] = usb_alloc_urb(0, GFP_KERNEL); + if (!priv->rx_urb[16]) + goto out_release_mem; + priv->oldaddr = kmalloc(16, GFP_KERNEL); if (!priv->oldaddr) - return -ENOMEM; + goto out_release_mem; + oldaddr = priv->oldaddr; align = ((long)oldaddr) & 3; if (align) { @@ -1686,17 +1691,19 @@ static short rtl8192_usb_initendpoints(struct net_device *dev) priv->pp_rxskb = kcalloc(MAX_RX_URB, sizeof(struct sk_buff *), GFP_KERNEL); if (!priv->pp_rxskb) { - kfree(priv->rx_urb); - - priv->pp_rxskb = NULL; - priv->rx_urb = NULL; - DMESGE("Endpoint Alloc Failure"); - return -ENOMEM; + goto out_release_mem; } netdev_dbg(dev, "End of initendpoints\n"); return 0; + +out_release_mem: + for (i = 0; i < (MAX_RX_URB + 1); i++) + kfree(priv->rx_urb[i]); + kfree(priv->rx_urb); + priv->rx_urb = NULL; + return -ENOMEM; } #ifdef THOMAS_BEACON -- 2.7.4 _______________________________________________ devel mailing list devel@xxxxxxxxxxxxxxxxxxxxxx http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel