From: Mariusz Kozlowski This is a bug. When checking for ati_remote->outbuf we free freeing ati_remote->inbuf so we end up freeing ati_remote->inbuf twice. Also the checks for 'ati_remote->inbuf != NULL' and 'ati_remote->outbuf != NULL' are redundant as usb_buffer_free() does this. Signed-off-by: Mariusz Kozlowski Cc: Greg KH Signed-off-by: Andrew Morton --- drivers/usb/input/ati_remote.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff -puN drivers/usb/input/ati_remote.c~usb-ati-remote-memleak-fix drivers/usb/input/ati_remote.c --- a/drivers/usb/input/ati_remote.c~usb-ati-remote-memleak-fix +++ a/drivers/usb/input/ati_remote.c @@ -636,13 +636,11 @@ static void ati_remote_free_buffers(stru if (ati_remote->out_urb) usb_free_urb(ati_remote->out_urb); - if (ati_remote->inbuf) - usb_buffer_free(ati_remote->udev, DATA_BUFSIZE, - ati_remote->inbuf, ati_remote->inbuf_dma); - - if (ati_remote->outbuf) - usb_buffer_free(ati_remote->udev, DATA_BUFSIZE, - ati_remote->inbuf, ati_remote->outbuf_dma); + usb_buffer_free(ati_remote->udev, DATA_BUFSIZE, + ati_remote->inbuf, ati_remote->inbuf_dma); + + usb_buffer_free(ati_remote->udev, DATA_BUFSIZE, + ati_remote->outbuf, ati_remote->outbuf_dma); } static void ati_remote_input_init(struct ati_remote *ati_remote) _