[xilinx-xlnx:xlnx_rebase_v5.15_LTS 337/1197] drivers/usb/storage/uas.c:564 uas_workaround() warn: possible memory leak of 'temp_request'

Dan Carpenter dan.carpenter at oracle.com
Sun Jun 26 23:14:49 PDT 2022


tree:   https://github.com/Xilinx/linux-xlnx xlnx_rebase_v5.15_LTS
head:   1e67f149fb5eb4f5eb4e0d4f69194eac6d2497d7
commit: 6e36c8e67532397180bc05d39599d0d16a82269c [337/1197] usb: uas: Add workaround for DATA IN urb's returned with status -EAGAIN
config: parisc-randconfig-m031-20220622
compiler: hppa-linux-gcc (GCC) 11.3.0

If you fix the issue, kindly add following tag where applicable
Reported-by: kernel test robot <lkp at intel.com>
Reported-by: Dan Carpenter <dan.carpenter at oracle.com>

smatch warnings:
drivers/usb/storage/uas.c:564 uas_workaround() warn: possible memory leak of 'temp_request'

vim +/temp_request +564 drivers/usb/storage/uas.c

6e36c8e6753239 Piyush Mehta 2022-01-26  459  static int uas_workaround(struct urb *urb)
6e36c8e6753239 Piyush Mehta 2022-01-26  460  {
6e36c8e6753239 Piyush Mehta 2022-01-26  461  	struct scsi_cmnd *cmnd = urb->context;
6e36c8e6753239 Piyush Mehta 2022-01-26  462  	struct scsi_device *sdev = cmnd->device;
6e36c8e6753239 Piyush Mehta 2022-01-26  463  	struct uas_dev_info *devinfo = (void *)cmnd->device->hostdata;
6e36c8e6753239 Piyush Mehta 2022-01-26  464  	struct scsi_cmnd *temp_cmnd;
6e36c8e6753239 Piyush Mehta 2022-01-26  465  	struct uas_cmd_info *temp_cmdinfo;
6e36c8e6753239 Piyush Mehta 2022-01-26  466  	struct urb *sense_urb, *data_urb, *cmnd_urb;
6e36c8e6753239 Piyush Mehta 2022-01-26  467  	struct request *temp_request;
6e36c8e6753239 Piyush Mehta 2022-01-26  468  	unsigned int idx;
6e36c8e6753239 Piyush Mehta 2022-01-26  469  	int err;
6e36c8e6753239 Piyush Mehta 2022-01-26  470  	char inquiry[16] = { 0x12, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0,
6e36c8e6753239 Piyush Mehta 2022-01-26  471  				0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0 };
6e36c8e6753239 Piyush Mehta 2022-01-26  472  
6e36c8e6753239 Piyush Mehta 2022-01-26  473  
6e36c8e6753239 Piyush Mehta 2022-01-26  474  	/* Find a free uas-tag */
6e36c8e6753239 Piyush Mehta 2022-01-26  475  	for (idx = 0; idx < devinfo->qdepth; idx++) {
6e36c8e6753239 Piyush Mehta 2022-01-26  476  		if (!devinfo->cmnd[idx])
6e36c8e6753239 Piyush Mehta 2022-01-26  477  			break;
6e36c8e6753239 Piyush Mehta 2022-01-26  478  	}
6e36c8e6753239 Piyush Mehta 2022-01-26  479  
6e36c8e6753239 Piyush Mehta 2022-01-26  480  	if (idx == devinfo->qdepth) {
6e36c8e6753239 Piyush Mehta 2022-01-26  481  		shost_printk(KERN_INFO, sdev->host,
6e36c8e6753239 Piyush Mehta 2022-01-26  482  			"%s: Failed to find free tag\n", __func__);
6e36c8e6753239 Piyush Mehta 2022-01-26  483  		err = -EINVAL;
6e36c8e6753239 Piyush Mehta 2022-01-26  484  		goto free;
6e36c8e6753239 Piyush Mehta 2022-01-26  485  	}
6e36c8e6753239 Piyush Mehta 2022-01-26  486  
6e36c8e6753239 Piyush Mehta 2022-01-26  487  	/* Create a scsi_cmnd and send dummy inquiry data on the next
6e36c8e6753239 Piyush Mehta 2022-01-26  488  	 * available tag
6e36c8e6753239 Piyush Mehta 2022-01-26  489  	 */
6e36c8e6753239 Piyush Mehta 2022-01-26  490  	temp_cmnd = kzalloc(sizeof(struct scsi_cmnd), GFP_ATOMIC);
6e36c8e6753239 Piyush Mehta 2022-01-26  491  	if (!temp_cmnd) {
6e36c8e6753239 Piyush Mehta 2022-01-26  492  		shost_printk(KERN_INFO, sdev->host,
6e36c8e6753239 Piyush Mehta 2022-01-26  493  			"%s: Failed to allocate memory for scsi_cmnd\n",
6e36c8e6753239 Piyush Mehta 2022-01-26  494  			__func__);
6e36c8e6753239 Piyush Mehta 2022-01-26  495  		err = -ENOMEM;
6e36c8e6753239 Piyush Mehta 2022-01-26  496  		goto free;
6e36c8e6753239 Piyush Mehta 2022-01-26  497  	}
6e36c8e6753239 Piyush Mehta 2022-01-26  498  
6e36c8e6753239 Piyush Mehta 2022-01-26  499  	temp_request = kzalloc(sizeof(struct request), GFP_ATOMIC);

The "temp_request" variable is never used.  Just delete it.  Smatch
complains that it is leaked on the success path.

6e36c8e6753239 Piyush Mehta 2022-01-26  500  	if (!temp_cmnd) {
6e36c8e6753239 Piyush Mehta 2022-01-26  501  		shost_printk(KERN_INFO, sdev->host,
6e36c8e6753239 Piyush Mehta 2022-01-26  502  			"%s: Failed to allocate memory for request\n",
6e36c8e6753239 Piyush Mehta 2022-01-26  503  			__func__);
6e36c8e6753239 Piyush Mehta 2022-01-26  504  		err = -ENOMEM;
6e36c8e6753239 Piyush Mehta 2022-01-26  505  		goto free;
6e36c8e6753239 Piyush Mehta 2022-01-26  506  	}
6e36c8e6753239 Piyush Mehta 2022-01-26  507  
6e36c8e6753239 Piyush Mehta 2022-01-26  508  	temp_cmnd->device = cmnd->device;
6e36c8e6753239 Piyush Mehta 2022-01-26  509  	temp_cmnd->cmnd = inquiry;
6e36c8e6753239 Piyush Mehta 2022-01-26  510  	temp_cmnd->cmd_len = 16;
6e36c8e6753239 Piyush Mehta 2022-01-26  511  	temp_cmnd->sdb.length = 0x10;
6e36c8e6753239 Piyush Mehta 2022-01-26  512  	temp_cmnd->scsi_done = dummy_scsi_done;
6e36c8e6753239 Piyush Mehta 2022-01-26  513  	temp_request->tag = idx;
6e36c8e6753239 Piyush Mehta 2022-01-26  514  
6e36c8e6753239 Piyush Mehta 2022-01-26  515  	temp_cmdinfo = (struct uas_cmd_info *)&temp_cmnd->SCp;
6e36c8e6753239 Piyush Mehta 2022-01-26  516  	memset(temp_cmdinfo, 0, sizeof(struct uas_cmd_info));
6e36c8e6753239 Piyush Mehta 2022-01-26  517  
6e36c8e6753239 Piyush Mehta 2022-01-26  518  	temp_cmdinfo->uas_tag = idx + 1;
6e36c8e6753239 Piyush Mehta 2022-01-26  519  	devinfo->cmnd[idx] = temp_cmnd;
6e36c8e6753239 Piyush Mehta 2022-01-26  520  
6e36c8e6753239 Piyush Mehta 2022-01-26  521  	/* Submit previously stopped URB first */
6e36c8e6753239 Piyush Mehta 2022-01-26  522  	err = usb_submit_urb(urb, GFP_ATOMIC);
6e36c8e6753239 Piyush Mehta 2022-01-26  523  	if (err) {
6e36c8e6753239 Piyush Mehta 2022-01-26  524  		shost_printk(KERN_INFO, sdev->host,
6e36c8e6753239 Piyush Mehta 2022-01-26  525  			"%s: submit err %d\n", __func__, err);
6e36c8e6753239 Piyush Mehta 2022-01-26  526  		kfree(temp_cmnd);
6e36c8e6753239 Piyush Mehta 2022-01-26  527  		kfree(temp_request);
6e36c8e6753239 Piyush Mehta 2022-01-26  528  		goto free;
6e36c8e6753239 Piyush Mehta 2022-01-26  529  	}
6e36c8e6753239 Piyush Mehta 2022-01-26  530  	usb_anchor_urb(urb, &devinfo->data_urbs);
6e36c8e6753239 Piyush Mehta 2022-01-26  531  
6e36c8e6753239 Piyush Mehta 2022-01-26  532  	/* Allocate and submit SENSE urb for next available tag */
6e36c8e6753239 Piyush Mehta 2022-01-26  533  	sense_urb = uas_workaround_sense(devinfo, GFP_ATOMIC, temp_cmnd);
6e36c8e6753239 Piyush Mehta 2022-01-26  534  	if (!sense_urb) {
6e36c8e6753239 Piyush Mehta 2022-01-26  535  		kfree(temp_request);
6e36c8e6753239 Piyush Mehta 2022-01-26  536  		kfree(temp_cmnd);
6e36c8e6753239 Piyush Mehta 2022-01-26  537  		goto free;
6e36c8e6753239 Piyush Mehta 2022-01-26  538  	}
6e36c8e6753239 Piyush Mehta 2022-01-26  539  
6e36c8e6753239 Piyush Mehta 2022-01-26  540  	/* Allocate and submit DATA IN urb for next available tag */
6e36c8e6753239 Piyush Mehta 2022-01-26  541  	data_urb = uas_workaround_data(devinfo, GFP_ATOMIC, temp_cmnd);
6e36c8e6753239 Piyush Mehta 2022-01-26  542  	if (!data_urb) {
6e36c8e6753239 Piyush Mehta 2022-01-26  543  		/* Kill previously allocated sense urb */
6e36c8e6753239 Piyush Mehta 2022-01-26  544  		sense_urb->context = NULL;
6e36c8e6753239 Piyush Mehta 2022-01-26  545  		usb_kill_urb(sense_urb);
6e36c8e6753239 Piyush Mehta 2022-01-26  546  		usb_put_urb(sense_urb);
6e36c8e6753239 Piyush Mehta 2022-01-26  547  		kfree(temp_request);
6e36c8e6753239 Piyush Mehta 2022-01-26  548  		kfree(temp_cmnd);
6e36c8e6753239 Piyush Mehta 2022-01-26  549  		goto free;
6e36c8e6753239 Piyush Mehta 2022-01-26  550  	}
6e36c8e6753239 Piyush Mehta 2022-01-26  551  
6e36c8e6753239 Piyush Mehta 2022-01-26  552  	/* Allocate and submit CMND urb with dummy inquiry data */
6e36c8e6753239 Piyush Mehta 2022-01-26  553  	cmnd_urb = uas_workaround_cmnd(devinfo, GFP_ATOMIC, temp_cmnd);
6e36c8e6753239 Piyush Mehta 2022-01-26  554  	if (!cmnd_urb) {
6e36c8e6753239 Piyush Mehta 2022-01-26  555  		/* Kill previously allocated data urb */
6e36c8e6753239 Piyush Mehta 2022-01-26  556  		data_urb->context = NULL;
6e36c8e6753239 Piyush Mehta 2022-01-26  557  		usb_kill_urb(data_urb);
6e36c8e6753239 Piyush Mehta 2022-01-26  558  		usb_put_urb(data_urb);
6e36c8e6753239 Piyush Mehta 2022-01-26  559  		kfree(temp_request);
6e36c8e6753239 Piyush Mehta 2022-01-26  560  		kfree(temp_cmnd);
6e36c8e6753239 Piyush Mehta 2022-01-26  561  	}
6e36c8e6753239 Piyush Mehta 2022-01-26  562  
6e36c8e6753239 Piyush Mehta 2022-01-26  563  free:
6e36c8e6753239 Piyush Mehta 2022-01-26 @564  	return err;
6e36c8e6753239 Piyush Mehta 2022-01-26  565  }

-- 
0-DAY CI Kernel Test Service
https://01.org/lkp




More information about the linux-arm-kernel mailing list