Re: memory leak in USB stack

[Manuel Bouyer <bouyer%antioche.eu.org@localhost>]

On Tue, Jan 12, 2010 at 09:32:50PM +0100, Matthias Drochner wrote:
> 
> bouyer%antioche.eu.org@localhost said:
> > The attached patch fixes this by freeing the xfer in
> > [eou]hci_device_intr_abort() and [eou]hci_root_intr_abort() when the
> > xfer to be aborted is the pipe's intrxfer.
> 
> Just for symmetry - can't this be done in usbd_abort_pipe(),
> preferrably outside the splusb()?

Are we sure nothing will change pipe->intrxfer under us outside of splusb ?
If so the attached patch should be safe, but I find it even uglier than the
previous one ..

-- 
Manuel Bouyer <bouyer%antioche.eu.org@localhost>
     NetBSD: 26 ans d'experience feront toujours la difference
--

Index: usbdi.c
===================================================================
RCS file: /cvsroot/src/sys/dev/usb/usbdi.c,v
retrieving revision 1.124.4.1
diff -u -p -u -r1.124.4.1 usbdi.c
--- usbdi.c     13 Dec 2008 21:44:42 -0000      1.124.4.1
+++ usbdi.c     13 Jan 2010 11:16:26 -0000
@@ -519,6 +519,7 @@ usbd_abort_pipe(usbd_pipe_handle pipe)
 {
        usbd_status err;
        int s;
+       usbd_xfer_handle intrxfer = pipe->intrxfer;
 
 #ifdef DIAGNOSTIC
        if (pipe == NULL) {
@@ -529,6 +530,8 @@ usbd_abort_pipe(usbd_pipe_handle pipe)
        s = splusb();
        err = usbd_ar_pipe(pipe);
        splx(s);
+       if (pipe->intrxfer != intrxfer)
+               usbd_free_xfer(intrxfer);
        return (err);
 }