USB: wusbcore/wa-xfer: error handling fixes in setup_segs()

1) It didn't free xfer->seg[0] so there was a leak.
2) xfer->seg[cnt] can be NULL.
3) Use usb_free_urb() for ->dto_urb instead of kfree().

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/usb/wusbcore/wa-xfer.c b/drivers/usb/wusbcore/wa-xfer.c
index 57c01ab09ad85209cedc966e90a3be2d94cb90f7..6ef94bce8c0dc49a5e118c642dbcb4e6c2beddf3 100644 (file)
--- a/drivers/usb/wusbcore/wa-xfer.c
+++ b/drivers/usb/wusbcore/wa-xfer.c
@@ -695,9 +695,9 @@ error_dto_alloc:
        cnt--;
 error_seg_kzalloc:
        /* use the fact that cnt is left at were it failed */
-       for (; cnt > 0; cnt--) {
-               if (xfer->is_inbound == 0)
-                       kfree(xfer->seg[cnt]->dto_urb);
+       for (; cnt >= 0; cnt--) {
+               if (xfer->seg[cnt] && xfer->is_inbound == 0)
+                       usb_free_urb(xfer->seg[cnt]->dto_urb);
                kfree(xfer->seg[cnt]);
        }
 error_segs_kzalloc: