summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorLinus Torvalds <torvalds@g5.osdl.org>2006-09-12 17:32:21 -0700
committerLinus Torvalds <torvalds@g5.osdl.org>2006-09-12 17:32:21 -0700
commit3ee4b889a0708e6503dca0f771c2d84f56602a18 (patch)
tree92c8ea1beb4b618f5e92e3bd809b31f37efb566d
parent7258ea8acd2252d5a68e7dfa2eac8dc8f364b91e (diff)
parent3e2aac366f40f4cf4f3b1d9101b27f703998dfbc (diff)
Merge master.kernel.org:/pub/scm/linux/kernel/git/gregkh/usb-2.6
* master.kernel.org:/pub/scm/linux/kernel/git/gregkh/usb-2.6: USB: Fix unload oops and memory leak in yealink driver usbserial: Reference leak
-rw-r--r--drivers/usb/input/yealink.c12
-rw-r--r--drivers/usb/serial/usb-serial.c4
2 files changed, 9 insertions, 7 deletions
diff --git a/drivers/usb/input/yealink.c b/drivers/usb/input/yealink.c
index 575a4e672e96..7b45fd3de911 100644
--- a/drivers/usb/input/yealink.c
+++ b/drivers/usb/input/yealink.c
@@ -810,12 +810,9 @@ static int usb_cleanup(struct yealink_dev *yld, int err)
if (yld == NULL)
return err;
- if (yld->urb_irq) {
- usb_kill_urb(yld->urb_irq);
- usb_free_urb(yld->urb_irq);
- }
- if (yld->urb_ctl)
- usb_free_urb(yld->urb_ctl);
+ usb_kill_urb(yld->urb_irq); /* parameter validation in core/urb */
+ usb_kill_urb(yld->urb_ctl); /* parameter validation in core/urb */
+
if (yld->idev) {
if (err)
input_free_device(yld->idev);
@@ -831,6 +828,9 @@ static int usb_cleanup(struct yealink_dev *yld, int err)
if (yld->irq_data)
usb_buffer_free(yld->udev, USB_PKT_LEN,
yld->irq_data, yld->irq_dma);
+
+ usb_free_urb(yld->urb_irq); /* parameter validation in core/urb */
+ usb_free_urb(yld->urb_ctl); /* parameter validation in core/urb */
kfree(yld);
return err;
}
diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
index 12c1694d322e..e06a41bd0f3b 100644
--- a/drivers/usb/serial/usb-serial.c
+++ b/drivers/usb/serial/usb-serial.c
@@ -464,8 +464,10 @@ static int serial_read_proc (char *page, char **start, off_t off, int count, int
length += sprintf (page+length, " path:%s", tmp);
length += sprintf (page+length, "\n");
- if ((length + begin) > (off + count))
+ if ((length + begin) > (off + count)) {
+ usb_serial_put(serial);
goto done;
+ }
if ((length + begin) < off) {
begin += length;
length = 0;