From: Arvid Brodin Date: Wed, 23 Nov 2011 17:13:02 +0000 (+0100) Subject: usb/isp1760: Fix race condition memory leak X-Git-Tag: v3.3-rc1~153^2~46 X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=c64391f264b7658c00515173cca58f5b054af1a2;p=pandora-kernel.git usb/isp1760: Fix race condition memory leak This fixes a memory leak reported by Catalin Marinas: schedule_ptds() is called from isp1760_irq() and removes the qh from the controlqhs queue but ep->hcpriv still points to the qh and therefore it is not freed. Shortly after this, the isp1760_endpoint_disable() function sets ep->hcpriv to NULL and calls schedule_ptds() but since the corresponding qh is no longer in the queue, it is simply forgotten and reported by kmemleak. With this patch, the qh is always freed at endpoint_disable, instead, and the corresponding entry removed from the queue head list. While I was at it, I also replaced the lines in isp1760_endpoint_disable() that removed remaining qtds from the qh with a WARN_ON check for non-empty qh, in line with earlier comments from Alan Stern (linux-usb list, 2011-07-20). Signed-off-by: Arvid Brodin Tested-by: Catalin Marinas Signed-off-by: Greg Kroah-Hartman --- Reading git-diff-tree failed