USB: io_edgeport: fix port-data memory leak

Fix port-data memory leak by moving port data allocation and
deallocation to port_probe and port_remove.

Since commit 0998d0631001288 (device-core: Ensure drvdata = NULL when no
driver is bound) the port private data is no longer freed at release as
it is no longer accessible.

Compile-only tested.

Cc: <stable@vger.kernel.org>
Signed-off-by: Johan Hovold <jhovold@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/usb/serial/io_edgeport.c b/drivers/usb/serial/io_edgeport.c
index 8e6faaf3580cb102abaea73be8d3636446dba7b6..5acc0d13864a400344a012400f20bc989fa23574 100644 (file)
--- a/drivers/usb/serial/io_edgeport.c
+++ b/drivers/usb/serial/io_edgeport.c
@@ -225,6 +225,8 @@ static int  edge_get_icount(struct tty_struct *tty,
 static int  edge_startup(struct usb_serial *serial);
 static void edge_disconnect(struct usb_serial *serial);
 static void edge_release(struct usb_serial *serial);
+static int edge_port_probe(struct usb_serial_port *port);
+static int edge_port_remove(struct usb_serial_port *port);
 
 #include "io_tables.h" /* all of the devices that this driver supports */
 
@@ -2875,10 +2877,9 @@ static void load_application_firmware(struct edgeport_serial *edge_serial)
 static int edge_startup(struct usb_serial *serial)
 {
        struct edgeport_serial *edge_serial;
-       struct edgeport_port *edge_port;
        struct usb_device *dev;
        struct device *ddev = &serial->dev->dev;
-       int i, j;
+       int i;
        int response;
        bool interrupt_in_found;
        bool bulk_in_found;
@@ -2961,25 +2962,6 @@ static int edge_startup(struct usb_serial *serial)
        /* we set up the pointers to the endpoints in the edge_open function,
         * as the structures aren't created yet. */
 
-       /* set up our port private structures */
-       for (i = 0; i < serial->num_ports; ++i) {
-               edge_port = kzalloc(sizeof(struct edgeport_port), GFP_KERNEL);
-               if (edge_port == NULL) {
-                       dev_err(ddev, "%s - Out of memory\n", __func__);
-                       for (j = 0; j < i; ++j) {
-                               kfree(usb_get_serial_port_data(serial->port[j]));
-                               usb_set_serial_port_data(serial->port[j],
-                                                                       NULL);
-                       }
-                       usb_set_serial_data(serial, NULL);
-                       kfree(edge_serial);
-                       return -ENOMEM;
-               }
-               spin_lock_init(&edge_port->ep_lock);
-               edge_port->port = serial->port[i];
-               usb_set_serial_port_data(serial->port[i], edge_port);
-       }
-
        response = 0;
 
        if (edge_serial->is_epic) {
@@ -3120,14 +3102,36 @@ static void edge_disconnect(struct usb_serial *serial)
 static void edge_release(struct usb_serial *serial)
 {
        struct edgeport_serial *edge_serial = usb_get_serial_data(serial);
-       int i;
-
-       for (i = 0; i < serial->num_ports; ++i)
-               kfree(usb_get_serial_port_data(serial->port[i]));
 
        kfree(edge_serial);
 }
 
+static int edge_port_probe(struct usb_serial_port *port)
+{
+       struct edgeport_port *edge_port;
+
+       edge_port = kzalloc(sizeof(*edge_port), GFP_KERNEL);
+       if (!edge_port)
+               return -ENOMEM;
+
+       spin_lock_init(&edge_port->ep_lock);
+       edge_port->port = port;
+
+       usb_set_serial_port_data(port, edge_port);
+
+       return 0;
+}
+
+static int edge_port_remove(struct usb_serial_port *port)
+{
+       struct edgeport_port *edge_port;
+
+       edge_port = usb_get_serial_port_data(port);
+       kfree(edge_port);
+
+       return 0;
+}
+
 module_usb_serial_driver(serial_drivers, id_table_combined);
 
 MODULE_AUTHOR(DRIVER_AUTHOR);

diff --git a/drivers/usb/serial/io_tables.h b/drivers/usb/serial/io_tables.h
index 350afddb55ba8c1fd276068518de05c78ac280ee..1511dd0ad3242650e6da605d316b2d7165b1fb2d 100644 (file)
--- a/drivers/usb/serial/io_tables.h
+++ b/drivers/usb/serial/io_tables.h
@@ -110,6 +110,8 @@ static struct usb_serial_driver edgeport_2port_device = {
        .attach                 = edge_startup,
        .disconnect             = edge_disconnect,
        .release                = edge_release,
+       .port_probe             = edge_port_probe,
+       .port_remove            = edge_port_remove,
        .ioctl                  = edge_ioctl,
        .set_termios            = edge_set_termios,
        .tiocmget               = edge_tiocmget,
@@ -139,6 +141,8 @@ static struct usb_serial_driver edgeport_4port_device = {
        .attach                 = edge_startup,
        .disconnect             = edge_disconnect,
        .release                = edge_release,
+       .port_probe             = edge_port_probe,
+       .port_remove            = edge_port_remove,
        .ioctl                  = edge_ioctl,
        .set_termios            = edge_set_termios,
        .tiocmget               = edge_tiocmget,
@@ -168,6 +172,8 @@ static struct usb_serial_driver edgeport_8port_device = {
        .attach                 = edge_startup,
        .disconnect             = edge_disconnect,
        .release                = edge_release,
+       .port_probe             = edge_port_probe,
+       .port_remove            = edge_port_remove,
        .ioctl                  = edge_ioctl,
        .set_termios            = edge_set_termios,
        .tiocmget               = edge_tiocmget,
@@ -197,6 +203,8 @@ static struct usb_serial_driver epic_device = {
        .attach                 = edge_startup,
        .disconnect             = edge_disconnect,
        .release                = edge_release,
+       .port_probe             = edge_port_probe,
+       .port_remove            = edge_port_remove,
        .ioctl                  = edge_ioctl,
        .set_termios            = edge_set_termios,
        .tiocmget               = edge_tiocmget,