Skip to content

Commit

Permalink
kaweth: Fix memory leak in kaweth_control()
Browse files Browse the repository at this point in the history
kaweth_control() never frees the buffer that it allocates for the USB
control message.  Test case:

while :; do ifconfig eth2 down ; ifconfig eth2 up ; done

This is a tiny buffer so it is a slow leak.  If you want to speed up the
process, you can change the allocation size to e.g. 16384 bytes, and it
will consume several megabytes within a few minutes.

Signed-off-by: Kevin Cernekee <cernekee@gmail.com>
Acked-by: Oliver Neukum <oliver@neukum.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
  • Loading branch information
Kevin Cernekee authored and David S. Miller committed Sep 22, 2009
1 parent 6f41d12 commit 051b982
Showing 1 changed file with 11 additions and 7 deletions.
18 changes: 11 additions & 7 deletions drivers/net/usb/kaweth.c
Original file line number Diff line number Diff line change
Expand Up @@ -263,6 +263,7 @@ static int kaweth_control(struct kaweth_device *kaweth,
int timeout)
{
struct usb_ctrlrequest *dr;
int retval;

dbg("kaweth_control()");

Expand All @@ -278,18 +279,21 @@ static int kaweth_control(struct kaweth_device *kaweth,
return -ENOMEM;
}

dr->bRequestType= requesttype;
dr->bRequestType = requesttype;
dr->bRequest = request;
dr->wValue = cpu_to_le16(value);
dr->wIndex = cpu_to_le16(index);
dr->wLength = cpu_to_le16(size);

return kaweth_internal_control_msg(kaweth->dev,
pipe,
dr,
data,
size,
timeout);
retval = kaweth_internal_control_msg(kaweth->dev,
pipe,
dr,
data,
size,
timeout);

kfree(dr);
return retval;
}

/****************************************************************
Expand Down

0 comments on commit 051b982

Please sign in to comment.