[PATCH] input: raspberrypi-ts: Fix refcount leak in rpi_ts_probe

[PATCH] input: raspberrypi-ts: Fix refcount leak in rpi_ts_probe

[Miaoqian Lin]

rpi_firmware_get() take reference, we need to release it in error paths
as well. Add missing rpi_firmware_put() in the error handling to fix it.

Fixes: 0b9f28fed3f7 ("Input: add official Raspberry Pi's touchscreen driver")
Fixes: 3b8ddff780b7 ("input: raspberrypi-ts: Release firmware handle when not needed")
Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
---
 drivers/input/touchscreen/raspberrypi-ts.c | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/drivers/input/touchscreen/raspberrypi-ts.c b/drivers/input/touchscreen/raspberrypi-ts.c
index 5000f5fd9ec3..114237c76378 100644
--- a/drivers/input/touchscreen/raspberrypi-ts.c
+++ b/drivers/input/touchscreen/raspberrypi-ts.c
@@ -140,21 +140,24 @@ static int rpi_ts_probe(struct platform_device *pdev)
 		return -EPROBE_DEFER;
 
 	ts = devm_kzalloc(dev, sizeof(*ts), GFP_KERNEL);
-	if (!ts)
-		return -ENOMEM;
+	if (!ts) {
+		error = -ENOMEM;
+		goto err_put_fw;
+	}
 	ts->pdev = pdev;
 
 	ts->fw_regs_va = dma_alloc_coherent(dev, PAGE_SIZE, &ts->fw_regs_phys,
 					    GFP_KERNEL);
 	if (!ts->fw_regs_va) {
 		dev_err(dev, "failed to dma_alloc_coherent\n");
-		return -ENOMEM;
+		error = -ENOMEM;
+		goto err_put_fw;
 	}
 
 	error = devm_add_action_or_reset(dev, rpi_ts_dma_cleanup, ts);
 	if (error) {
 		dev_err(dev, "failed to devm_add_action_or_reset, %d\n", error);
-		return error;
+		goto err_put_fw;
 	}
 
 	touchbuf = (u32)ts->fw_regs_phys;
@@ -206,6 +209,10 @@ static int rpi_ts_probe(struct platform_device *pdev)
 	}
 
 	return 0;
+
+err_put_fw:
+	rpi_firmware_put(fw);
+	return error;
 }
 
 static const struct of_device_id rpi_ts_match[] = {
-- 
2.25.1

Re: [PATCH] input: raspberrypi-ts: Fix refcount leak in rpi_ts_probe

[Dmitry Torokhov]

On Tue, Dec 20, 2022 at 03:52:43PM +0400, Miaoqian Lin wrote:
> rpi_firmware_get() take reference, we need to release it in error paths
> as well. Add missing rpi_firmware_put() in the error handling to fix it.

Hmm, it used not to take a reference, but now it does... OK.

But I see there is devm_rpi_firmware_get() variant, we should be using
it instead of mixing up manual and devm-controller resources to ensure
proper release order.

Thanks.

-- 
Dmitry