USB: Memory leak in drivers/usb/serial/airprime.c
[powerpc.git] / drivers / usb / serial / airprime.c
1 /*
2  * AirPrime CDMA Wireless Serial USB driver
3  *
4  * Copyright (C) 2005-2006 Greg Kroah-Hartman <gregkh@suse.de>
5  *
6  *      This program is free software; you can redistribute it and/or
7  *      modify it under the terms of the GNU General Public License version
8  *      2 as published by the Free Software Foundation.
9  */
10
11 #include <linux/kernel.h>
12 #include <linux/init.h>
13 #include <linux/tty.h>
14 #include <linux/tty_flip.h>
15 #include <linux/module.h>
16 #include <linux/usb.h>
17 #include <linux/usb/serial.h>
18
19 static struct usb_device_id id_table [] = {
20         { USB_DEVICE(0x0c88, 0x17da) }, /* Kyocera Wireless KPC650/Passport */
21         { USB_DEVICE(0x0f3d, 0x0112) }, /* AirPrime CDMA Wireless PC Card */
22         { USB_DEVICE(0x1199, 0x0017) }, /* Sierra Wireless EM5625 */
23         { USB_DEVICE(0x1199, 0x0018) }, /* Sierra Wireless MC5720 */
24         { USB_DEVICE(0x1199, 0x0112) }, /* Sierra Wireless Aircard 580 */
25         { USB_DEVICE(0x1199, 0x0218) }, /* Sierra Wireless MC5720 */
26         { USB_DEVICE(0x1410, 0x1110) }, /* Novatel Wireless Merlin CDMA */
27         { USB_DEVICE(0x1410, 0x1100) }, /* ExpressCard34 Qualcomm 3G CDMA */
28         { },
29 };
30 MODULE_DEVICE_TABLE(usb, id_table);
31
32 #define URB_TRANSFER_BUFFER_SIZE        4096
33 #define NUM_READ_URBS                   4
34 #define NUM_WRITE_URBS                  4
35 #define NUM_BULK_EPS                    3
36 #define MAX_BULK_EPS                    6
37
38 /* if overridden by the user, then use their value for the size of the
39  * read and write urbs, and the number of endpoints */
40 static int buffer_size = URB_TRANSFER_BUFFER_SIZE;
41 static int endpoints = NUM_BULK_EPS;
42 static int debug;
43 struct airprime_private {
44         spinlock_t lock;
45         int outstanding_urbs;
46         int throttled;
47         struct urb *read_urbp[NUM_READ_URBS];
48 };
49
50 static void airprime_read_bulk_callback(struct urb *urb)
51 {
52         struct usb_serial_port *port = urb->context;
53         unsigned char *data = urb->transfer_buffer;
54         struct tty_struct *tty;
55         int result;
56
57         dbg("%s - port %d", __FUNCTION__, port->number);
58
59         if (urb->status) {
60                 dbg("%s - nonzero read bulk status received: %d",
61                     __FUNCTION__, urb->status);
62                 /* something happened, so free up the memory for this urb */
63                 if (urb->transfer_buffer) {
64                         kfree (urb->transfer_buffer);
65                         urb->transfer_buffer = NULL;
66                 }
67                 return;
68         }
69         usb_serial_debug_data(debug, &port->dev, __FUNCTION__, urb->actual_length, data);
70
71         tty = port->tty;
72         if (tty && urb->actual_length) {
73                 tty_insert_flip_string (tty, data, urb->actual_length);
74                 tty_flip_buffer_push (tty);
75         }
76
77         result = usb_submit_urb (urb, GFP_ATOMIC);
78         if (result)
79                 dev_err(&port->dev, "%s - failed resubmitting read urb, error %d\n",
80                         __FUNCTION__, result);
81         return;
82 }
83
84 static void airprime_write_bulk_callback(struct urb *urb)
85 {
86         struct usb_serial_port *port = urb->context;
87         struct airprime_private *priv = usb_get_serial_port_data(port);
88         unsigned long flags;
89
90         dbg("%s - port %d", __FUNCTION__, port->number);
91
92         /* free up the transfer buffer, as usb_free_urb() does not do this */
93         kfree (urb->transfer_buffer);
94
95         if (urb->status)
96                 dbg("%s - nonzero write bulk status received: %d",
97                     __FUNCTION__, urb->status);
98         spin_lock_irqsave(&priv->lock, flags);
99         --priv->outstanding_urbs;
100         spin_unlock_irqrestore(&priv->lock, flags);
101
102         usb_serial_port_softint(port);
103 }
104
105 static int airprime_open(struct usb_serial_port *port, struct file *filp)
106 {
107         struct airprime_private *priv = usb_get_serial_port_data(port);
108         struct usb_serial *serial = port->serial;
109         struct urb *urb;
110         char *buffer = NULL;
111         int i;
112         int result = 0;
113
114         dbg("%s - port %d", __FUNCTION__, port->number);
115
116         /* initialize our private data structure if it isn't already created */
117         if (!priv) {
118                 priv = kzalloc(sizeof(*priv), GFP_KERNEL);
119                 if (!priv) {
120                         result = -ENOMEM;
121                         goto out;
122                 }
123                 spin_lock_init(&priv->lock);
124                 usb_set_serial_port_data(port, priv);
125         }
126
127         for (i = 0; i < NUM_READ_URBS; ++i) {
128                 buffer = kmalloc(buffer_size, GFP_KERNEL);
129                 if (!buffer) {
130                         dev_err(&port->dev, "%s - out of memory.\n",
131                                 __FUNCTION__);
132                         result = -ENOMEM;
133                         goto errout;
134                 }
135                 urb = usb_alloc_urb(0, GFP_KERNEL);
136                 if (!urb) {
137                         kfree(buffer);
138                         dev_err(&port->dev, "%s - no more urbs?\n",
139                                 __FUNCTION__);
140                         result = -ENOMEM;
141                         goto errout;
142                 }
143                 usb_fill_bulk_urb(urb, serial->dev,
144                                   usb_rcvbulkpipe(serial->dev,
145                                                   port->bulk_out_endpointAddress),
146                                   buffer, buffer_size,
147                                   airprime_read_bulk_callback, port);
148                 result = usb_submit_urb(urb, GFP_KERNEL);
149                 if (result) {
150                         dev_err(&port->dev,
151                                 "%s - failed submitting read urb %d for port %d, error %d\n",
152                                 __FUNCTION__, i, port->number, result);
153                         goto errout;
154                 }
155                 /* remember this urb so we can kill it when the port is closed */
156                 priv->read_urbp[i] = urb;
157         }
158         goto out;
159
160  errout:
161         /* some error happened, cancel any submitted urbs and clean up anything that
162            got allocated successfully */
163
164         for ( ; i >= 0; --i) {
165                 urb = priv->read_urbp[i];
166                 if (urb) {
167                         /* This urb was submitted successfully. So we have to
168                            cancel it.
169                            Unlinking the urb will invoke read_bulk_callback()
170                            with an error status, so its transfer buffer will
171                            be freed there */
172                         if (usb_unlink_urb (urb) != -EINPROGRESS) {
173                                 /* comments in drivers/usb/core/urb.c say this
174                                    can only happen if the urb was never submitted,
175                                    or has completed already.
176                                    Either way we may have to free the transfer
177                                    buffer here. */
178                                 if (urb->transfer_buffer) {
179                                         kfree (urb->transfer_buffer);
180                                         urb->transfer_buffer = NULL;
181                                 }
182                         }
183                         usb_free_urb (urb);
184                 }
185         }
186
187  out:
188         return result;
189 }
190
191 static void airprime_close(struct usb_serial_port *port, struct file * filp)
192 {
193         struct airprime_private *priv = usb_get_serial_port_data(port);
194         int i;
195
196         dbg("%s - port %d", __FUNCTION__, port->number);
197
198         /* killing the urb will invoke read_bulk_callback() with an error status,
199            so the transfer buffer will be freed there */
200         for (i = 0; i < NUM_READ_URBS; ++i) {
201                 usb_kill_urb (priv->read_urbp[i]);
202                 usb_free_urb (priv->read_urbp[i]);
203         }
204
205         /* free up private structure */
206         kfree (priv);
207         usb_set_serial_port_data(port, NULL);
208 }
209
210 static int airprime_write(struct usb_serial_port *port,
211                           const unsigned char *buf, int count)
212 {
213         struct airprime_private *priv = usb_get_serial_port_data(port);
214         struct usb_serial *serial = port->serial;
215         struct urb *urb;
216         unsigned char *buffer;
217         unsigned long flags;
218         int status;
219         dbg("%s - port %d", __FUNCTION__, port->number);
220
221         spin_lock_irqsave(&priv->lock, flags);
222         if (priv->outstanding_urbs > NUM_WRITE_URBS) {
223                 spin_unlock_irqrestore(&priv->lock, flags);
224                 dbg("%s - write limit hit\n", __FUNCTION__);
225                 return 0;
226         }
227         spin_unlock_irqrestore(&priv->lock, flags);
228         buffer = kmalloc(count, GFP_ATOMIC);
229         if (!buffer) {
230                 dev_err(&port->dev, "out of memory\n");
231                 return -ENOMEM;
232         }
233         urb = usb_alloc_urb(0, GFP_ATOMIC);
234         if (!urb) {
235                 dev_err(&port->dev, "no more free urbs\n");
236                 kfree (buffer);
237                 return -ENOMEM;
238         }
239         memcpy (buffer, buf, count);
240
241         usb_serial_debug_data(debug, &port->dev, __FUNCTION__, count, buffer);
242
243         usb_fill_bulk_urb(urb, serial->dev,
244                           usb_sndbulkpipe(serial->dev,
245                                           port->bulk_out_endpointAddress),
246                           buffer, count,
247                           airprime_write_bulk_callback, port);
248
249         /* send it down the pipe */
250         status = usb_submit_urb(urb, GFP_ATOMIC);
251         if (status) {
252                 dev_err(&port->dev,
253                         "%s - usb_submit_urb(write bulk) failed with status = %d\n",
254                         __FUNCTION__, status);
255                 count = status;
256                 kfree (buffer);
257         } else {
258                 spin_lock_irqsave(&priv->lock, flags);
259                 ++priv->outstanding_urbs;
260                 spin_unlock_irqrestore(&priv->lock, flags);
261         }
262         /* we are done with this urb, so let the host driver
263          * really free it when it is finished with it */
264         usb_free_urb (urb);
265         return count;
266 }
267
268 static struct usb_driver airprime_driver = {
269         .name =         "airprime",
270         .probe =        usb_serial_probe,
271         .disconnect =   usb_serial_disconnect,
272         .id_table =     id_table,
273         .no_dynamic_id =        1,
274 };
275
276 static struct usb_serial_driver airprime_device = {
277         .driver = {
278                 .owner =        THIS_MODULE,
279                 .name =         "airprime",
280         },
281         .id_table =             id_table,
282         .num_interrupt_in =     NUM_DONT_CARE,
283         .num_bulk_in =          NUM_DONT_CARE,
284         .num_bulk_out =         NUM_DONT_CARE,
285         .open =                 airprime_open,
286         .close =                airprime_close,
287         .write =                airprime_write,
288 };
289
290 static int __init airprime_init(void)
291 {
292         int retval;
293
294         airprime_device.num_ports =
295                 (endpoints > 0 && endpoints <= MAX_BULK_EPS) ? endpoints : NUM_BULK_EPS;
296         retval = usb_serial_register(&airprime_device);
297         if (retval)
298                 return retval;
299         retval = usb_register(&airprime_driver);
300         if (retval)
301                 usb_serial_deregister(&airprime_device);
302         return retval;
303 }
304
305 static void __exit airprime_exit(void)
306 {
307         dbg("%s", __FUNCTION__);
308
309         usb_deregister(&airprime_driver);
310         usb_serial_deregister(&airprime_device);
311 }
312
313 module_init(airprime_init);
314 module_exit(airprime_exit);
315 MODULE_LICENSE("GPL");
316
317 module_param(debug, bool, S_IRUGO | S_IWUSR);
318 MODULE_PARM_DESC(debug, "Debug enabled");
319 module_param(buffer_size, int, 0);
320 MODULE_PARM_DESC(buffer_size, "Size of the transfer buffers in bytes (default 4096)");
321 module_param(endpoints, int, 0);
322 MODULE_PARM_DESC(endpoints, "Number of bulk EPs to configure (default 3)");