tty/n_gsm.c: fix a memory leak in gsmld_open

[cascardo/linux.git] / drivers / tty / n_gsm.c

diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
index 2ebe47b..152443a 100644 (file)
--- a/drivers/tty/n_gsm.c
+++ b/drivers/tty/n_gsm.c
@@ -2088,9 +2088,7 @@ static int gsm_activate_mux(struct gsm_mux *gsm)
        struct gsm_dlci *dlci;
        int i = 0;
 
-       init_timer(&gsm->t2_timer);
-       gsm->t2_timer.function = gsm_control_retransmit;
-       gsm->t2_timer.data = (unsigned long)gsm;
+       setup_timer(&gsm->t2_timer, gsm_control_retransmit, (unsigned long)gsm);
        init_waitqueue_head(&gsm->event);
        spin_lock_init(&gsm->control_lock);
        spin_lock_init(&gsm->tx_lock);
@@ -2230,8 +2228,7 @@ static int gsmld_output(struct gsm_mux *gsm, u8 *data, int len)
 
 static int gsmld_attach_gsm(struct tty_struct *tty, struct gsm_mux *gsm)
 {
-       int ret, i;
-       int base = gsm->num << 6; /* Base for this MUX */
+       int ret, i, base;
 
        gsm->tty = tty_kref_get(tty);
        gsm->output = gsmld_output;
@@ -2241,6 +2238,7 @@ static int gsmld_attach_gsm(struct tty_struct *tty, struct gsm_mux *gsm)
        else {
                /* Don't register device 0 - this is the control channel and not
                   a usable tty interface */
+               base = gsm->num << 6; /* Base for this MUX */
                for (i = 1; i < NUM_DLCI; i++)
                        tty_register_device(gsm_tty_driver, base + i, NULL);
        }
@@ -2368,6 +2366,7 @@ static void gsmld_close(struct tty_struct *tty)
 static int gsmld_open(struct tty_struct *tty)
 {
        struct gsm_mux *gsm;
+       int ret;
 
        if (tty->ops->write == NULL)
                return -EINVAL;
@@ -2382,7 +2381,13 @@ static int gsmld_open(struct tty_struct *tty)
 
        /* Attach the initial passive connection */
        gsm->encoding = 1;
-       return gsmld_attach_gsm(tty, gsm);
+
+       ret = gsmld_attach_gsm(tty, gsm);
+       if (ret != 0) {
+               gsm_cleanup_mux(gsm);
+               mux_put(gsm);
+       }
+       return ret;
 }
 
 /**