USB: serial: mos7720: fix mos_parport refcount imbalance on error path

commit 2908b076f5198d231de62713cb2b633a3a4b95ac upstream.

The write_parport_reg_nonblock() helper takes a reference to the struct
mos_parport, but failed to release it in a couple of error paths after
allocation failures, leading to a memory leak.

Johan said that move the kref_get() and mos_parport assignment to the
end of urbtrack initialisation is a better way, so move it. and
mos_parport do not used until urbtrack initialisation.

Signed-off-by: Lin Yi <teroincn@163.com>
Fixes: b69578df7e98 ("USB: usbserial: mos7720: add support for parallel port on moschip 7715")
Cc: stable <stable@vger.kernel.org>     # 2.6.35
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/usb/serial/mos7720.c b/drivers/usb/serial/mos7720.c
index a453965f9e9a3153ffcbb28d4a6257a4db094cd3..393a91ab56eda557b80287bab45bf5c65e15c326 100644 (file)
--- a/drivers/usb/serial/mos7720.c
+++ b/drivers/usb/serial/mos7720.c
@@ -368,8 +368,6 @@ static int write_parport_reg_nonblock(struct mos7715_parport *mos_parport,
        if (!urbtrack)
                return -ENOMEM;
 
-       kref_get(&mos_parport->ref_count);
-       urbtrack->mos_parport = mos_parport;
        urbtrack->urb = usb_alloc_urb(0, GFP_ATOMIC);
        if (!urbtrack->urb) {
                kfree(urbtrack);
@@ -390,6 +388,8 @@ static int write_parport_reg_nonblock(struct mos7715_parport *mos_parport,
                             usb_sndctrlpipe(usbdev, 0),
                             (unsigned char *)urbtrack->setup,
                             NULL, 0, async_complete, urbtrack);
+       kref_get(&mos_parport->ref_count);
+       urbtrack->mos_parport = mos_parport;
        kref_init(&urbtrack->ref_count);
        INIT_LIST_HEAD(&urbtrack->urblist_entry);