From f07af4b630d52fb911574031ed7feb9252e65f24 Mon Sep 17 00:00:00 2001 From: Dan Carpenter Date: Fri, 1 Feb 2013 15:53:34 +0300 Subject: [PATCH] USB: wusbcore/wa-xfer: error handling fixes in setup_segs() 1) It didn't free xfer->seg[0] so there was a leak. 2) xfer->seg[cnt] can be NULL. 3) Use usb_free_urb() for ->dto_urb instead of kfree(). Signed-off-by: Dan Carpenter Signed-off-by: Greg Kroah-Hartman --- drivers/usb/wusbcore/wa-xfer.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/usb/wusbcore/wa-xfer.c b/drivers/usb/wusbcore/wa-xfer.c index 57c01ab09ad8..6ef94bce8c0d 100644 --- a/drivers/usb/wusbcore/wa-xfer.c +++ b/drivers/usb/wusbcore/wa-xfer.c @@ -695,9 +695,9 @@ static int __wa_xfer_setup_segs(struct wa_xfer *xfer, size_t xfer_hdr_size) cnt--; error_seg_kzalloc: /* use the fact that cnt is left at were it failed */ - for (; cnt > 0; cnt--) { - if (xfer->is_inbound == 0) - kfree(xfer->seg[cnt]->dto_urb); + for (; cnt >= 0; cnt--) { + if (xfer->seg[cnt] && xfer->is_inbound == 0) + usb_free_urb(xfer->seg[cnt]->dto_urb); kfree(xfer->seg[cnt]); } error_segs_kzalloc: