staging: rtl8192u: fix multiple memory leaks on error path

[ Upstream commit ca312438cf176a16d4b89350cade8789ba8d7133 ]

In rtl8192_tx on error handling path allocated urbs and also skb should
be released.

Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Link: https://lore.kernel.org/r/20190920025137.29407-1-navid.emamdoost@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/staging/rtl8192u/r8192U_core.c b/drivers/staging/rtl8192u/r8192U_core.c
index e218b5c..2066a1d 100644 (file)
--- a/drivers/staging/rtl8192u/r8192U_core.c
+++ b/drivers/staging/rtl8192u/r8192U_core.c
@@ -1467,7 +1467,7 @@ short rtl8192_tx(struct net_device *dev, struct sk_buff *skb)
                (struct tx_fwinfo_819x_usb *)(skb->data + USB_HWDESC_HEADER_LEN);
        struct usb_device *udev = priv->udev;
        int pend;
-       int status;
+       int status, rt = -1;
        struct urb *tx_urb = NULL, *tx_urb_zero = NULL;
        unsigned int idx_pipe;
 
@@ -1611,8 +1611,10 @@ short rtl8192_tx(struct net_device *dev, struct sk_buff *skb)
                }
                if (bSend0Byte) {
                        tx_urb_zero = usb_alloc_urb(0, GFP_ATOMIC);
-                       if (!tx_urb_zero)
-                               return -ENOMEM;
+                       if (!tx_urb_zero) {
+                               rt = -ENOMEM;
+                               goto error;
+                       }
                        usb_fill_bulk_urb(tx_urb_zero, udev,
                                          usb_sndbulkpipe(udev, idx_pipe),
                                          &zero, 0, tx_zero_isr, dev);
@@ -1622,7 +1624,7 @@ short rtl8192_tx(struct net_device *dev, struct sk_buff *skb)
                                         "Error TX URB for zero byte %d, error %d",
                                         atomic_read(&priv->tx_pending[tcb_desc->queue_index]),
                                         status);
-                               return -1;
+                               goto error;
                        }
                }
                netif_trans_update(dev);
@@ -1633,7 +1635,12 @@ short rtl8192_tx(struct net_device *dev, struct sk_buff *skb)
        RT_TRACE(COMP_ERR, "Error TX URB %d, error %d",
                 atomic_read(&priv->tx_pending[tcb_desc->queue_index]),
                 status);
-       return -1;
+
+error:
+       dev_kfree_skb_any(skb);
+       usb_free_urb(tx_urb);
+       usb_free_urb(tx_urb_zero);
+       return rt;
 }
 
 static short rtl8192_usb_initendpoints(struct net_device *dev)