1) It didn't free xfer->seg[0] so there was a leak. 2) xfer->seg[cnt] can be NULL. 3) Use usb_free_urb() for ->dto_urb instead of kfree().
Signed-off-by: Dan Carpenter <dan.carpen...@oracle.com> diff --git a/drivers/usb/wusbcore/wa-xfer.c b/drivers/usb/wusbcore/wa-xfer.c index 57c01ab..6ef94bc 100644 --- a/drivers/usb/wusbcore/wa-xfer.c +++ b/drivers/usb/wusbcore/wa-xfer.c @@ -695,9 +695,9 @@ error_dto_alloc: cnt--; error_seg_kzalloc: /* use the fact that cnt is left at were it failed */ - for (; cnt > 0; cnt--) { - if (xfer->is_inbound == 0) - kfree(xfer->seg[cnt]->dto_urb); + for (; cnt >= 0; cnt--) { + if (xfer->seg[cnt] && xfer->is_inbound == 0) + usb_free_urb(xfer->seg[cnt]->dto_urb); kfree(xfer->seg[cnt]); } error_segs_kzalloc: -- To unsubscribe from this list: send the line "unsubscribe linux-usb" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html