Re: [CHECKER]: malloc/free errors part III

[Johannes Erdfelt]

On Fri, Aug 11, 2000, Dawson Engler <[e-mail]> wrote:
> ------------------------------------------------------------------------
> /u2/engler/ic/linux-2.3.99/drivers/usb/usb.c:1115:usb_parse_configuration: ERROR: did not free config on error path
> 
> Not sure: looks like you'll just overwrite it on the second pass:
> 
>         config->interface = (struct usb_interface *)
>                 kmalloc(config->bNumInterfaces *
>                 sizeof(struct usb_interface), GFP_KERNEL);

Second pass?

FWIW, usb_destroy_configuration does free this.

This is assuming that whoever calls usb_get_configuration (which
eventually ends up calling usb_parse_configuration) handles the error
code correctly and calls usb_destroy_configuration, which it doesn't.

> UNSURE, but it looks like all these interface allocations will be lost.
> If it fails, they just get overwritten.

I don't understand what you mean by "overwritten"?

> /u2/engler/ic/linux-2.3.99/drivers/usb/usb.c:1038:usb_parse_interface: ERROR: did not free interface on error path
> /u2/engler/ic/linux-2.3.99/drivers/usb/usb.c:1023:usb_parse_interface: ERROR: did not free interface on error path
> /u2/engler/ic/linux-2.3.99/drivers/usb/usb.c:990:usb_parse_interface: ERROR: did not free interface on error path
> /u2/engler/ic/linux-2.3.99/drivers/usb/usb.c:956:usb_parse_interface: ERROR: did not free interface on error path
> /u2/engler/ic/linux-2.3.99/drivers/usb/usb.c:1057:usb_parse_interface: ERROR: did not free interface on error path
> /u2/engler/ic/linux-2.3.99/drivers/usb/usb.c:1046:usb_parse_interface: ERROR: did not free interface on error path

Why did it show many of those multiple times?

These fall under the same category as the first.

Randy, I'll submit a patch for these.

Dawson, thanks for hacking this test up!

JE