usb: gadget: phonet: free requests in pn_bind()'s error path

commit d0eca719dd11ad0619e8dd6a1f3eceb95b0216dd upstream.

Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Felipe Balbi <balbi@ti.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>

diff --git a/drivers/usb/gadget/f_phonet.c b/drivers/usb/gadget/f_phonet.c
index 16a509ae517b6b5a317422aa2553ce1316da46c5..54314939b2f3edd90db82e36158439d52bc9e95d 100644 (file)
--- a/drivers/usb/gadget/f_phonet.c
+++ b/drivers/usb/gadget/f_phonet.c
@@ -532,7 +532,7 @@ int pn_bind(struct usb_configuration *c, struct usb_function *f)
 
                req = usb_ep_alloc_request(fp->out_ep, GFP_KERNEL);
                if (!req)
-                       goto err;
+                       goto err_req;
 
                req->complete = pn_rx_complete;
                fp->out_reqv[i] = req;
@@ -541,14 +541,18 @@ int pn_bind(struct usb_configuration *c, struct usb_function *f)
        /* Outgoing USB requests */
        fp->in_req = usb_ep_alloc_request(fp->in_ep, GFP_KERNEL);
        if (!fp->in_req)
-               goto err;
+               goto err_req;
 
        INFO(cdev, "USB CDC Phonet function\n");
        INFO(cdev, "using %s, OUT %s, IN %s\n", cdev->gadget->name,
                fp->out_ep->name, fp->in_ep->name);
        return 0;
 
+err_req:
+       for (i = 0; i < phonet_rxq_size && fp->out_reqv[i]; i++)
+               usb_ep_free_request(fp->out_ep, fp->out_reqv[i]);
 err:
+
        if (fp->out_ep)
                fp->out_ep->driver_data = NULL;
        if (fp->in_ep)