USB: serial: io_edgeport: fix memory leak in edge_startup

sysbot found memory leak in edge_startup().
The problem was that when an error was received from the usb_submit_urb(),
nothing was cleaned up.

Reported-by: syzbot+59f777bdcbdd7eea5305@syzkaller.appspotmail.com
Signed-off-by: Pavel Skripkin <paskripkin@gmail.com>
Fixes: 6e8cf7751f9f ("USB: add EPIC support to the io_edgeport driver")
Cc: stable@vger.kernel.org	# 2.6.21: c5c0c55598ce
Signed-off-by: Johan Hovold <johan@kernel.org>

diff --git a/drivers/usb/serial/io_edgeport.c b/drivers/usb/serial/io_edgeport.c
index a493670c06e61bec880ed1e00be2c32fa401de0f..68401adcffde590b8f9daefe343b9b688bb07c09 100644 (file)
--- a/drivers/usb/serial/io_edgeport.c
+++ b/drivers/usb/serial/io_edgeport.c
@@ -3003,26 +3003,32 @@ static int edge_startup(struct usb_serial *serial)
                                response = -ENODEV;
                        }
 
-                       usb_free_urb(edge_serial->interrupt_read_urb);
-                       kfree(edge_serial->interrupt_in_buffer);
-
-                       usb_free_urb(edge_serial->read_urb);
-                       kfree(edge_serial->bulk_in_buffer);
-
-                       kfree(edge_serial);
-
-                       return response;
+                       goto error;
                }
 
                /* start interrupt read for this edgeport this interrupt will
                 * continue as long as the edgeport is connected */
                response = usb_submit_urb(edge_serial->interrupt_read_urb,
                                                                GFP_KERNEL);
-               if (response)
+               if (response) {
                        dev_err(ddev, "%s - Error %d submitting control urb\n",
                                __func__, response);
+
+                       goto error;
+               }
        }
        return response;
+
+error:
+       usb_free_urb(edge_serial->interrupt_read_urb);
+       kfree(edge_serial->interrupt_in_buffer);
+
+       usb_free_urb(edge_serial->read_urb);
+       kfree(edge_serial->bulk_in_buffer);
+
+       kfree(edge_serial);
+
+       return response;
 }