From 0ae4ea8092e1277cfca07cade7eaba5f594076c1 Mon Sep 17 00:00:00 2001
From: Alan Stern <stern@rowland.harvard.edu>
Date: Mon, 22 May 2006 12:27:38 -0400
Subject: [PATCH] [PATCH] gadgetfs: fix memory leaks

This patch (as692) fixes a few memory leaks in some unimportant error
pathways of the gadgetfs driver.

Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Acked-by: David Brownell <david-b@pacbell.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
---
 drivers/usb/gadget/inode.c | 51 ++++++++++++++++++++++----------------
 1 file changed, 29 insertions(+), 22 deletions(-)

diff --git a/drivers/usb/gadget/inode.c b/drivers/usb/gadget/inode.c
index 57bf24810f..aef0722b8f 100644
--- a/drivers/usb/gadget/inode.c
+++ b/drivers/usb/gadget/inode.c
@@ -1038,7 +1038,7 @@ scan:
 		/* ep0 can't deliver events when STATE_SETUP */
 		for (i = 0; i < n; i++) {
 			if (dev->event [i].type == GADGETFS_SETUP) {
-				len = n = i + 1;
+				len = i + 1;
 				len *= sizeof (struct usb_gadgetfs_event);
 				n = 0;
 				break;
@@ -1586,13 +1586,13 @@ gadgetfs_create_file (struct super_block *sb, char const *name,
 static int activate_ep_files (struct dev_data *dev)
 {
 	struct usb_ep	*ep;
+	struct ep_data	*data;
 
 	gadget_for_each_ep (ep, dev->gadget) {
-		struct ep_data	*data;
 
 		data = kzalloc(sizeof(*data), GFP_KERNEL);
 		if (!data)
-			goto enomem;
+			goto enomem0;
 		data->state = STATE_EP_DISABLED;
 		init_MUTEX (&data->lock);
 		init_waitqueue_head (&data->wait);
@@ -1607,21 +1607,23 @@ static int activate_ep_files (struct dev_data *dev)
 
 		data->req = usb_ep_alloc_request (ep, GFP_KERNEL);
 		if (!data->req)
-			goto enomem;
+			goto enomem1;
 
 		data->inode = gadgetfs_create_file (dev->sb, data->name,
 				data, &ep_config_operations,
 				&data->dentry);
-		if (!data->inode) {
-			usb_ep_free_request(ep, data->req);
-			kfree (data);
-			goto enomem;
-		}
+		if (!data->inode)
+			goto enomem2;
 		list_add_tail (&data->epfiles, &dev->epfiles);
 	}
 	return 0;
 
-enomem:
+enomem2:
+	usb_ep_free_request (ep, data->req);
+enomem1:
+	put_dev (dev);
+	kfree (data);
+enomem0:
 	DBG (dev, "%s enomem\n", __FUNCTION__);
 	destroy_ep_files (dev);
 	return -ENOMEM;
@@ -1792,7 +1794,7 @@ static struct usb_gadget_driver probe_driver = {
  *
  * After initialization, the device stays active for as long as that
  * $CHIP file is open.  Events may then be read from that descriptor,
- * such configuration notifications.  More complex drivers will handle
+ * such as configuration notifications.  More complex drivers will handle
  * some control requests in user space.
  */
 
@@ -2032,12 +2034,10 @@ gadgetfs_fill_super (struct super_block *sb, void *opts, int silent)
 			NULL, &simple_dir_operations,
 			S_IFDIR | S_IRUGO | S_IXUGO);
 	if (!inode)
-		return -ENOMEM;
+		goto enomem0;
 	inode->i_op = &simple_dir_inode_operations;
-	if (!(d = d_alloc_root (inode))) {
-		iput (inode);
-		return -ENOMEM;
-	}
+	if (!(d = d_alloc_root (inode)))
+		goto enomem1;
 	sb->s_root = d;
 
 	/* the ep0 file is named after the controller we expect;
@@ -2045,21 +2045,28 @@ gadgetfs_fill_super (struct super_block *sb, void *opts, int silent)
 	 */
 	dev = dev_new ();
 	if (!dev)
-		return -ENOMEM;
+		goto enomem2;
 
 	dev->sb = sb;
-	if (!(inode = gadgetfs_create_file (sb, CHIP,
+	if (!gadgetfs_create_file (sb, CHIP,
 				dev, &dev_init_operations,
-				&dev->dentry))) {
-		put_dev(dev);
-		return -ENOMEM;
-	}
+				&dev->dentry))
+		goto enomem3;
 
 	/* other endpoint files are available after hardware setup,
 	 * from binding to a controller.
 	 */
 	the_device = dev;
 	return 0;
+
+enomem3:
+	put_dev (dev);
+enomem2:
+	dput (d);
+enomem1:
+	iput (inode);
+enomem0:
+	return -ENOMEM;
 }
 
 /* "mount -t gadgetfs path /dev/gadget" ends up here */
-- 
2.39.5