mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-11-01 17:08:10 +00:00
Code Issues Releases Wiki Activity

kaweth: Fix memory leak in kaweth_control()

Browse source 
kaweth_control() never frees the buffer that it allocates for the USB
control message.  Test case:

while :; do ifconfig eth2 down ; ifconfig eth2 up ; done

This is a tiny buffer so it is a slow leak.  If you want to speed up the
process, you can change the allocation size to e.g. 16384 bytes, and it
will consume several megabytes within a few minutes.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
Acked-by: Oliver Neukum <oliver@neukum.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Kevin Cernekee 2009-09-19 11:18:21 +00:00 committed by David S. Miller
parent 6f41d12bab
commit 051b982bcc
1 changed files with 11 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
drivers/net/usb/kaweth.c
View file

@ -263,6 +263,7 @@ static int kaweth_control(struct kaweth_device *kaweth,
int timeout) int timeout)
{ {
struct usb_ctrlrequest *dr; struct usb_ctrlrequest *dr;
int retval;
dbg("kaweth_control()"); dbg("kaweth_control()");
@ -278,18 +279,21 @@ static int kaweth_control(struct kaweth_device *kaweth,
return -ENOMEM; return -ENOMEM;
} }
dr->bRequestType= requesttype; dr->bRequestType = requesttype;
dr->bRequest = request; dr->bRequest = request;
dr->wValue = cpu_to_le16(value); dr->wValue = cpu_to_le16(value);
dr->wIndex = cpu_to_le16(index); dr->wIndex = cpu_to_le16(index);
dr->wLength = cpu_to_le16(size); dr->wLength = cpu_to_le16(size);
return kaweth_internal_control_msg(kaweth->dev, retval = kaweth_internal_control_msg(kaweth->dev,
pipe, pipe,
dr, dr,
data, data,
size, size,
timeout); timeout);
kfree(dr);
return retval;
} }
/**************************************************************** /****************************************************************