Merge master.kernel.org:/pub/scm/linux/kernel/git/gregkh/usb-2.6

* master.kernel.org:/pub/scm/linux/kernel/git/gregkh/usb-2.6:
  USB: Fix unload oops and memory leak in yealink driver
  usbserial: Reference leak

2 files changed, 9 insertions, 7 deletions

diff --git a/drivers/usb/input/yealink.c b/drivers/usb/input/yealink.c
index 575a4e672e96..7b45fd3de911 100644
--- a/drivers/usb/input/yealink.c
+++ b/drivers/usb/input/yealink.c
@@ -810,12 +810,9 @@ static int usb_cleanup(struct yealink_dev *yld, int err)
         if (yld == NULL)
                 return err;
 
-        if (yld->urb_irq) {
-                usb_kill_urb(yld->urb_irq);
-                usb_free_urb(yld->urb_irq);
-        }
-        if (yld->urb_ctl)
-                usb_free_urb(yld->urb_ctl);
+        usb_kill_urb(yld->urb_irq);     /* parameter validation in core/urb */
+        usb_kill_urb(yld->urb_ctl);     /* parameter validation in core/urb */
+
         if (yld->idev) {
                 if (err)
                         input_free_device(yld->idev);
@@ -831,6 +828,9 @@ static int usb_cleanup(struct yealink_dev *yld, int err)
         if (yld->irq_data)
                 usb_buffer_free(yld->udev, USB_PKT_LEN,
                                 yld->irq_data, yld->irq_dma);
+
+        usb_free_urb(yld->urb_irq);     /* parameter validation in core/urb */
+        usb_free_urb(yld->urb_ctl);     /* parameter validation in core/urb */
         kfree(yld);
         return err;
 }
diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
index 12c1694d322e..e06a41bd0f3b 100644
--- a/drivers/usb/serial/usb-serial.c
+++ b/drivers/usb/serial/usb-serial.c
@@ -464,8 +464,10 @@ static int serial_read_proc (char *page, char **start, off_t off, int count, int
                 length += sprintf (page+length, " path:%s", tmp);
                         
                 length += sprintf (page+length, "\n");
-                if ((length + begin) > (off + count))
+                if ((length + begin) > (off + count)) {
+                        usb_serial_put(serial);
                         goto done;
+                }
                 if ((length + begin) < off) {
                         begin += length;
                         length = 0;