[patch 3/3] Input: cyttsp4 - leak on error path in probe()

[patch 3/3] Input: cyttsp4 - leak on error path in probe()

[Dan Carpenter]

We leak "cd" if the cd->xfer_buf allocation fails.  It was weird to
"goto error_gpio_irq" so I changed the label name.  (Label names should
reflect the label location not the goto location otherwise you get an
"all roads lead to Rome problem").

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

diff --git a/drivers/input/touchscreen/cyttsp4_core.c b/drivers/input/touchscreen/cyttsp4_core.c
index 851e3ff..a7987e1 100644
--- a/drivers/input/touchscreen/cyttsp4_core.c
+++ b/drivers/input/touchscreen/cyttsp4_core.c
@@ -2025,7 +2025,7 @@ struct cyttsp4 *cyttsp4_probe(const struct cyttsp4_bus_ops *ops,
 	if (!cd->xfer_buf) {
 		dev_err(dev, "%s: Error, kzalloc\n", __func__);
 		rc = -ENOMEM;
-		goto error_alloc_data;
+		goto error_free_cd;
 	}
 
 	/* Initialize device info */
@@ -2049,7 +2049,7 @@ struct cyttsp4 *cyttsp4_probe(const struct cyttsp4_bus_ops *ops,
 	cd->irq = gpio_to_irq(cd->cpdata->irq_gpio);
 	if (cd->irq < 0) {
 		rc = -EINVAL;
-		goto error_gpio_irq;
+		goto error_free_cd;
 	}
 
 	dev_set_drvdata(dev, cd);
@@ -2117,7 +2117,7 @@ error_request_irq:
 	if (cd->cpdata->init)
 		cd->cpdata->init(cd->cpdata, 0, dev);
 	dev_set_drvdata(dev, NULL);
-error_gpio_irq:
+error_free_cd:
 	kfree(cd);
 error_alloc_data:
 error_no_pdata:

Re: [patch 3/3] Input: cyttsp4 - leak on error path in probe()

[Ferruh Yigit]

On 07/03/2013 12:44 AM, Dan Carpenter wrote:
> We leak "cd" if the cd->xfer_buf allocation fails.  It was weird to
> "goto error_gpio_irq" so I changed the label name.  (Label names should
> reflect the label location not the goto location otherwise you get an
> "all roads lead to Rome problem").
>
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
>
xfer_buf still may not be freed, I propose following one instead:

From: Ferruh Yigit <fery@cypress.com>
Date: Wed, 3 Jul 2013 15:59:54 +0300
Subject: [PATCH] Input: cyttsp4 - free xfer_buf in error path

Label for xfer_buf error is wrong and causing mem leak for cd.
Updated label for xfer_buf alloc failure and add kfree for xfer_buf

Signed-off-by: Ferruh Yigit <fery@cypress.com>
---
  drivers/input/touchscreen/cyttsp4_core.c |    4 +++-
  1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/input/touchscreen/cyttsp4_core.c
b/drivers/input/touchscreen/cyttsp4_core.c
index 69c9cff..219e32d 100644
--- a/drivers/input/touchscreen/cyttsp4_core.c
+++ b/drivers/input/touchscreen/cyttsp4_core.c
@@ -2034,7 +2034,7 @@ struct cyttsp4 *cyttsp4_probe(const struct
cyttsp4_bus_ops *ops,
      if (!cd->xfer_buf) {
          dev_err(dev, "%s: Error, kzalloc\n", __func__);
          rc = -ENOMEM;
-        goto error_alloc_data;
+        goto error_alloc_xfer;
      }

      /* Initialize device info */
@@ -2127,6 +2127,8 @@ error_request_irq:
          cd->cpdata->init(cd->cpdata, 0, dev);
      dev_set_drvdata(dev, NULL);
  error_gpio_irq:
+    kfree(cd->xfer_buf);
+error_alloc_xfer:
      kfree(cd);
  error_alloc_data:
  error_no_pdata:
--
1.7.9.5
This message and any attachments may contain Cypress (or its subsidiaries) confidential information. If it has been received in error, please advise the sender and immediately delete this message.

Re: [patch 3/3] Input: cyttsp4 - leak on error path in probe()

[Dan Carpenter]

On Wed, Jul 03, 2013 at 04:12:48PM +0300, Ferruh Yigit wrote:
> On 07/03/2013 12:44 AM, Dan Carpenter wrote:
> >We leak "cd" if the cd->xfer_buf allocation fails.  It was weird to
> >"goto error_gpio_irq" so I changed the label name.  (Label names should
> >reflect the label location not the goto location otherwise you get an
> >"all roads lead to Rome problem").
> >
> >Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> >
> xfer_buf still may not be freed, I propose following one instead:
> 

That's a good point.  I missed that leak.  The problem is that my
patch was already applied so this patch would have to be re-written
on top of that.  Also this patch is whitespace dammaged and won't
apply.

regards,
dan carpenter

Re: [patch 3/3] Input: cyttsp4 - leak on error path in probe()

[Ferruh Yigit]

On 07/03/2013 04:50 PM, Dan Carpenter wrote:
> On Wed, Jul 03, 2013 at 04:12:48PM +0300, Ferruh Yigit wrote:
>> On 07/03/2013 12:44 AM, Dan Carpenter wrote:
>>> We leak "cd" if the cd->xfer_buf allocation fails.  It was weird to
>>> "goto error_gpio_irq" so I changed the label name.  (Label names should
>>> reflect the label location not the goto location otherwise you get an
>>> "all roads lead to Rome problem").
>>>
>>> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
>>>
>> xfer_buf still may not be freed, I propose following one instead:
>>
> That's a good point.  I missed that leak.  The problem is that my
> patch was already applied so this patch would have to be re-written
> on top of that.  Also this patch is whitespace dammaged and won't
> apply.
OK, I am preparing the patch over previous one.

Thanks,
ferruh
This message and any attachments may contain Cypress (or its subsidiaries) confidential information. If it has been received in error, please advise the sender and immediately delete this message.

[PATCH] Input: cyttsp4 - kfree xfer_buf on error path in probe()

[Ferruh Yigit]

If probe() fails after cd->xfer_buf allocated, it will not freed.
Added kfree(cd->xfer_buf) with and error label.

Signed-off-by: Ferruh Yigit <fery@cypress.com>
---
 drivers/input/touchscreen/cyttsp4_core.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/input/touchscreen/cyttsp4_core.c b/drivers/input/touchscreen/cyttsp4_core.c
index a7987e1..edcf799 100644
--- a/drivers/input/touchscreen/cyttsp4_core.c
+++ b/drivers/input/touchscreen/cyttsp4_core.c
@@ -2049,7 +2049,7 @@ struct cyttsp4 *cyttsp4_probe(const struct cyttsp4_bus_ops *ops,
 	cd->irq = gpio_to_irq(cd->cpdata->irq_gpio);
 	if (cd->irq < 0) {
 		rc = -EINVAL;
-		goto error_free_cd;
+		goto error_free_xfer;
 	}
 
 	dev_set_drvdata(dev, cd);
@@ -2117,6 +2117,8 @@ error_request_irq:
 	if (cd->cpdata->init)
 		cd->cpdata->init(cd->cpdata, 0, dev);
 	dev_set_drvdata(dev, NULL);
+error_free_xfer:
+	kfree(cd->xfer_buf);
 error_free_cd:
 	kfree(cd);
 error_alloc_data:
-- 
1.7.9.5