From fa1ac1406a0836c352dbf321a2429ba58dfcd51c Mon Sep 17 00:00:00 2001 From: Hemant Kumar Date: Mon, 2 May 2016 10:46:49 -0700 Subject: USB: gadget: mtp: Fix bug in freeing memory on allocation failure Current driver code doesn't handle the memory allocation failure correctly and ends up leaking memory and trying to free unallocated one. Change-Id: I7e3527b7e08ccfe566d85e3009d8a015d8daa707 Signed-off-by: Manu Gautam Signed-off-by: Hemant Kumar --- drivers/usb/gadget/function/f_mtp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/usb/gadget/function/f_mtp.c b/drivers/usb/gadget/function/f_mtp.c index ea3721fe73e9..f63ab883c5b9 100644 --- a/drivers/usb/gadget/function/f_mtp.c +++ b/drivers/usb/gadget/function/f_mtp.c @@ -552,7 +552,7 @@ retry_rx_alloc: if (!req) { if (mtp_rx_req_len <= MTP_BULK_BUFFER_SIZE) goto fail; - for (; i > 0; i--) + for (--i; i >= 0; i--) mtp_request_free(dev->rx_req[i], dev->ep_out); mtp_rx_req_len = MTP_BULK_BUFFER_SIZE; goto retry_rx_alloc; -- cgit v1.2.3