hso: fix memory leak in hso_create_rfkill()
authorOlivier Sobrie <olivier@sobrie.be>
Fri, 30 Jan 2015 12:21:56 +0000 (13:21 +0100)
committerDavid S. Miller <davem@davemloft.net>
Sun, 1 Feb 2015 20:33:26 +0000 (12:33 -0800)
When the rfkill interface was created, a buffer containing the name
of the rfkill node was allocated. This buffer was never freed when the
device disappears.

To fix the problem, we put the name given to rfkill_alloc() in
the hso_net structure.

Signed-off-by: Olivier Sobrie <olivier@sobrie.be>
Signed-off-by: David S. Miller <davem@davemloft.net>
drivers/net/usb/hso.c

index d855cead397886101badb1900cc9379c98e02ece..e1cfe19c72d5a57b085780d7306498557becf358 100644 (file)
@@ -153,6 +153,7 @@ struct hso_net {
        struct hso_device *parent;
        struct net_device *net;
        struct rfkill *rfkill;
+       char name[8];
 
        struct usb_endpoint_descriptor *in_endp;
        struct usb_endpoint_descriptor *out_endp;
@@ -2467,27 +2468,20 @@ static void hso_create_rfkill(struct hso_device *hso_dev,
 {
        struct hso_net *hso_net = dev2net(hso_dev);
        struct device *dev = &hso_net->net->dev;
-       char *rfkn;
 
-       rfkn = kzalloc(20, GFP_KERNEL);
-       if (!rfkn)
-               dev_err(dev, "%s - Out of memory\n", __func__);
-
-       snprintf(rfkn, 20, "hso-%d",
+       snprintf(hso_net->name, sizeof(hso_net->name), "hso-%d",
                 interface->altsetting->desc.bInterfaceNumber);
 
-       hso_net->rfkill = rfkill_alloc(rfkn,
+       hso_net->rfkill = rfkill_alloc(hso_net->name,
                                       &interface_to_usbdev(interface)->dev,
                                       RFKILL_TYPE_WWAN,
                                       &hso_rfkill_ops, hso_dev);
        if (!hso_net->rfkill) {
                dev_err(dev, "%s - Out of memory\n", __func__);
-               kfree(rfkn);
                return;
        }
        if (rfkill_register(hso_net->rfkill) < 0) {
                rfkill_destroy(hso_net->rfkill);
-               kfree(rfkn);
                hso_net->rfkill = NULL;
                dev_err(dev, "%s - Failed to register rfkill\n", __func__);
                return;