diff options
| author | Linus Torvalds <torvalds@g5.osdl.org> | 2006-09-12 17:32:21 -0700 |
|---|---|---|
| committer | Linus Torvalds <torvalds@g5.osdl.org> | 2006-09-12 17:32:21 -0700 |
| commit | 3ee4b889a0708e6503dca0f771c2d84f56602a18 (patch) | |
| tree | 92c8ea1beb4b618f5e92e3bd809b31f37efb566d | |
| parent | 7258ea8acd2252d5a68e7dfa2eac8dc8f364b91e (diff) | |
| parent | 3e2aac366f40f4cf4f3b1d9101b27f703998dfbc (diff) | |
Merge master.kernel.org:/pub/scm/linux/kernel/git/gregkh/usb-2.6
* master.kernel.org:/pub/scm/linux/kernel/git/gregkh/usb-2.6:
USB: Fix unload oops and memory leak in yealink driver
usbserial: Reference leak
| -rw-r--r-- | drivers/usb/input/yealink.c | 12 | ||||
| -rw-r--r-- | drivers/usb/serial/usb-serial.c | 4 |
2 files changed, 9 insertions, 7 deletions
diff --git a/drivers/usb/input/yealink.c b/drivers/usb/input/yealink.c index 575a4e672e96..7b45fd3de911 100644 --- a/drivers/usb/input/yealink.c +++ b/drivers/usb/input/yealink.c @@ -810,12 +810,9 @@ static int usb_cleanup(struct yealink_dev *yld, int err) if (yld == NULL) return err; - if (yld->urb_irq) { - usb_kill_urb(yld->urb_irq); - usb_free_urb(yld->urb_irq); - } - if (yld->urb_ctl) - usb_free_urb(yld->urb_ctl); + usb_kill_urb(yld->urb_irq); /* parameter validation in core/urb */ + usb_kill_urb(yld->urb_ctl); /* parameter validation in core/urb */ + if (yld->idev) { if (err) input_free_device(yld->idev); @@ -831,6 +828,9 @@ static int usb_cleanup(struct yealink_dev *yld, int err) if (yld->irq_data) usb_buffer_free(yld->udev, USB_PKT_LEN, yld->irq_data, yld->irq_dma); + + usb_free_urb(yld->urb_irq); /* parameter validation in core/urb */ + usb_free_urb(yld->urb_ctl); /* parameter validation in core/urb */ kfree(yld); return err; } diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c index 12c1694d322e..e06a41bd0f3b 100644 --- a/drivers/usb/serial/usb-serial.c +++ b/drivers/usb/serial/usb-serial.c @@ -464,8 +464,10 @@ static int serial_read_proc (char *page, char **start, off_t off, int count, int length += sprintf (page+length, " path:%s", tmp); length += sprintf (page+length, "\n"); - if ((length + begin) > (off + count)) + if ((length + begin) > (off + count)) { + usb_serial_put(serial); goto done; + } if ((length + begin) < off) { begin += length; length = 0; |