Re: kern/39322: Memoryleaks in Ohci Driver (USB)

[Matthias Drochner <M.Drochner%fz-juelich.de@localhost>]

andreas.jacobs%lancom.de@localhost said:
> Here is a patch for that

Thanks -- looks OK, but the memory is allocated by malloc(),
so it should be freed by free()... could you check whether
the appended patch works for you?

best regards
Matthias





-------------------------------------------------------------------
-------------------------------------------------------------------
Forschungszentrum Juelich GmbH
52425 Juelich

Sitz der Gesellschaft: Juelich
Eingetragen im Handelsregister des Amtsgerichts Dueren Nr. HR B 3498
Vorsitzende des Aufsichtsrats: MinDir'in Baerbel Brumme-Bothe
Geschaeftsfuehrung: Prof. Dr. Achim Bachem (Vorsitzender),
Dr. Ulrich Krafft (stellv. Vorsitzender), Prof. Dr. Harald Bolt,
Dr. Sebastian M. Schmidt
-------------------------------------------------------------------
-------------------------------------------------------------------

#
# old_revision [05483fc8817ab109a28dae727d55611ef093c9cf]
#
# patch "sys/dev/usb/ohci.c"
#  from [66ec729b074362214149b22651b8d37d0658f6b6]
#    to [961ba09736eaeb4045e7500fd0fd467129e262c4]
#
============================================================
--- sys/dev/usb/ohci.c  66ec729b074362214149b22651b8d37d0658f6b6
+++ sys/dev/usb/ohci.c  961ba09736eaeb4045e7500fd0fd467129e262c4
@@ -385,6 +385,7 @@ ohci_detach(struct ohci_softc *sc, int f
 ohci_detach(struct ohci_softc *sc, int flags)
 {
        int rv = 0;
+       usbd_xfer_handle xfer;
 
        if (sc->sc_child != NULL)
                rv = config_detach(sc->sc_child, flags);
@@ -396,7 +397,11 @@ ohci_detach(struct ohci_softc *sc, int f
 
        usb_delay_ms(&sc->sc_bus, 300); /* XXX let stray task complete */
 
-       /* free data structures XXX */
+       usb_freemem(&sc->sc_bus, &sc->sc_hccadma);
+       while((xfer = SIMPLEQ_FIRST(&sc->sc_free_xfers)) != NULL) {
+               SIMPLEQ_REMOVE_HEAD(&sc->sc_free_xfers, next);
+               free(xfer, M_USB);
+       }
 
        return (rv);
 }