From 5541952d090a573f49d5265fcfefb4e2455a20e4 Mon Sep 17 00:00:00 2001 From: Alexander Viro Date: Wed, 3 Mar 2004 21:21:34 -0800 Subject: [PATCH] [PATCH] d_alloc_root() fixes: gadgetfs gatgetfs fill_super: - double-free of inode on last two failure exits - leak on the last failure exit - touching addresses near 0 on last two failure exits --- drivers/usb/gadget/inode.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/drivers/usb/gadget/inode.c b/drivers/usb/gadget/inode.c index 8d4a76751411e..394bfbd8d3b2a 100644 --- a/drivers/usb/gadget/inode.c +++ b/drivers/usb/gadget/inode.c @@ -1812,7 +1812,6 @@ gadgetfs_fill_super (struct super_block *sb, void *opts, int silent) return -ENOMEM; inode->i_op = &simple_dir_inode_operations; if (!(d = d_alloc_root (inode))) { -enomem: iput (inode); return -ENOMEM; } @@ -1823,12 +1822,15 @@ enomem: */ dev = dev_new (); if (!dev) - goto enomem; + return -ENOMEM; + dev->sb = sb; if (!(inode = gadgetfs_create_file (sb, CHIP, dev, &dev_init_operations, - &dev->dentry))) - goto enomem; + &dev->dentry))) { + put_dev(dev); + return -ENOMEM; + } /* other endpoint files are available after hardware setup, * from binding to a controller. @@ -1849,8 +1851,10 @@ static void gadgetfs_kill_sb (struct super_block *sb) { kill_litter_super (sb); - put_dev (the_device); - the_device = 0; + if (the_device) { + put_dev (the_device); + the_device = 0; + } } /*----------------------------------------------------------------------*/ -- 2.53.0