usb: gadget: function: Remove redundant usb_free_all_descriptors

Removed usb_free_all_descriptors in the bind functions, which
results in double-free corruption of the descriptors on error path.
The usb descriptors are allocated by usb_assign_descriptors.

Signed-off-by: Pavitrakumar Managutte <pavitra1729@gmail.com>
Reviewed-by: Robert Baldyga <r.baldyga@samsung.com>
Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Felipe Balbi <balbi@ti.com>

diff --git a/drivers/usb/gadget/function/f_eem.c b/drivers/usb/gadget/function/f_eem.c
index 4d8b236ea60865c9fb85c013b416ea0a7f9476b6..c9e90de5bdd9192c459dd3dea7a9aafa3c086c6b 100644 (file)
--- a/drivers/usb/gadget/function/f_eem.c
+++ b/drivers/usb/gadget/function/f_eem.c
@@ -325,7 +325,6 @@ static int eem_bind(struct usb_configuration *c, struct usb_function *f)
        return 0;
 
 fail:
-       usb_free_all_descriptors(f);
        if (eem->port.out_ep)
                eem->port.out_ep->driver_data = NULL;
        if (eem->port.in_ep)

diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c
index a95290a1289f8946829fbab180c7c76f807c791f..59ab62c92b66667e77b4ba35cd59f754584e0fd2 100644 (file)
--- a/drivers/usb/gadget/function/f_hid.c
+++ b/drivers/usb/gadget/function/f_hid.c
@@ -621,12 +621,14 @@ static int __init hidg_bind(struct usb_configuration *c, struct usb_function *f)
        dev = MKDEV(major, hidg->minor);
        status = cdev_add(&hidg->cdev, dev, 1);
        if (status)
-               goto fail;
+               goto fail_free_descs;
 
        device_create(hidg_class, NULL, dev, NULL, "%s%d", "hidg", hidg->minor);
 
        return 0;
 
+fail_free_descs:
+       usb_free_all_descriptors(f);
 fail:
        ERROR(f->config->cdev, "hidg_bind FAILED\n");
        if (hidg->req != NULL) {
@@ -635,7 +637,6 @@ fail:
                        usb_ep_free_request(hidg->in_ep, hidg->req);
        }
 
-       usb_free_all_descriptors(f);
        return status;
 }
 

diff --git a/drivers/usb/gadget/function/f_ncm.c b/drivers/usb/gadget/function/f_ncm.c
index 146f48cc65d7fb9c000565448121337f914c694c..16361b0a8b469644120907f5a135d3f7d5156b11 100644 (file)
--- a/drivers/usb/gadget/function/f_ncm.c
+++ b/drivers/usb/gadget/function/f_ncm.c
@@ -1461,7 +1461,6 @@ static int ncm_bind(struct usb_configuration *c, struct usb_function *f)
        return 0;
 
 fail:
-       usb_free_all_descriptors(f);
        if (ncm->notify_req) {
                kfree(ncm->notify_req->buf);
                usb_ep_free_request(ncm->notify, ncm->notify_req);

diff --git a/drivers/usb/gadget/function/f_obex.c b/drivers/usb/gadget/function/f_obex.c
index 1a1a490415f49df06883c4153efcde9dd670a840..a1b79c53499c2f4e852b1599347df3a400337745 100644 (file)
--- a/drivers/usb/gadget/function/f_obex.c
+++ b/drivers/usb/gadget/function/f_obex.c
@@ -397,7 +397,6 @@ static int obex_bind(struct usb_configuration *c, struct usb_function *f)
        return 0;
 
 fail:
-       usb_free_all_descriptors(f);
        /* we might as well release our claims on endpoints */
        if (obex->port.out)
                obex->port.out->driver_data = NULL;

diff --git a/drivers/usb/gadget/function/f_phonet.c b/drivers/usb/gadget/function/f_phonet.c
index b9cfc1571d71281c0607abf0420fb518796626fe..1ec8b7ffdccd40aadf3b70abfed20fd85935a649 100644 (file)
--- a/drivers/usb/gadget/function/f_phonet.c
+++ b/drivers/usb/gadget/function/f_phonet.c
@@ -570,8 +570,8 @@ static int pn_bind(struct usb_configuration *c, struct usb_function *f)
 err_req:
        for (i = 0; i < phonet_rxq_size && fp->out_reqv[i]; i++)
                usb_ep_free_request(fp->out_ep, fp->out_reqv[i]);
-err:
        usb_free_all_descriptors(f);
+err:
        if (fp->out_ep)
                fp->out_ep->driver_data = NULL;
        if (fp->in_ep)

diff --git a/drivers/usb/gadget/function/f_rndis.c b/drivers/usb/gadget/function/f_rndis.c
index ddb09dc6d1f2382f556ce378dada0b13df1f8462..2f0517f5bae32939b4a91a7d978f75612a9d19e3 100644 (file)
--- a/drivers/usb/gadget/function/f_rndis.c
+++ b/drivers/usb/gadget/function/f_rndis.c
@@ -803,7 +803,7 @@ rndis_bind(struct usb_configuration *c, struct usb_function *f)
        if (rndis->manufacturer && rndis->vendorID &&
                        rndis_set_param_vendor(rndis->config, rndis->vendorID,
                                               rndis->manufacturer))
-               goto fail;
+               goto fail_free_descs;
 
        /* NOTE:  all that is done without knowing or caring about
         * the network link ... which is unavailable to this code
@@ -817,10 +817,11 @@ rndis_bind(struct usb_configuration *c, struct usb_function *f)
                        rndis->notify->name);
        return 0;
 
+fail_free_descs:
+       usb_free_all_descriptors(f);
 fail:
        kfree(f->os_desc_table);
        f->os_desc_n = 0;
-       usb_free_all_descriptors(f);
 
        if (rndis->notify_req) {
                kfree(rndis->notify_req->buf);

diff --git a/drivers/usb/gadget/function/f_subset.c b/drivers/usb/gadget/function/f_subset.c
index 1ea8baf33333be75990c6c1b7d2d6208192f7375..e3dfa675ff06db9ca627e6d211f30263f298eb8f 100644 (file)
--- a/drivers/usb/gadget/function/f_subset.c
+++ b/drivers/usb/gadget/function/f_subset.c
@@ -380,7 +380,6 @@ geth_bind(struct usb_configuration *c, struct usb_function *f)
        return 0;
 
 fail:
-       usb_free_all_descriptors(f);
        /* we might as well release our claims on endpoints */
        if (geth->port.out_ep)
                geth->port.out_ep->driver_data = NULL;

diff --git a/drivers/usb/gadget/function/f_uac2.c b/drivers/usb/gadget/function/f_uac2.c
index 9296e598428c6efdb986ac7da9d3d089c1b2c205..33e16658e5cfeb50d01c44c7a63a2379634e82b7 100644 (file)
--- a/drivers/usb/gadget/function/f_uac2.c
+++ b/drivers/usb/gadget/function/f_uac2.c
@@ -1084,7 +1084,7 @@ afunc_bind(struct usb_configuration *cfg, struct usb_function *fn)
        prm->rbuf = kzalloc(prm->max_psize * USB_XFERS, GFP_KERNEL);
        if (!prm->rbuf) {
                prm->max_psize = 0;
-               goto err;
+               goto err_free_descs;
        }
 
        prm = &agdev->uac2.p_prm;
@@ -1092,17 +1092,19 @@ afunc_bind(struct usb_configuration *cfg, struct usb_function *fn)
        prm->rbuf = kzalloc(prm->max_psize * USB_XFERS, GFP_KERNEL);
        if (!prm->rbuf) {
                prm->max_psize = 0;
-               goto err;
+               goto err_free_descs;
        }
 
        ret = alsa_uac2_init(agdev);
        if (ret)
-               goto err;
+               goto err_free_descs;
        return 0;
+
+err_free_descs:
+       usb_free_all_descriptors(fn);
 err:
        kfree(agdev->uac2.p_prm.rbuf);
        kfree(agdev->uac2.c_prm.rbuf);
-       usb_free_all_descriptors(fn);
        if (agdev->in_ep)
                agdev->in_ep->driver_data = NULL;
        if (agdev->out_ep)