* [PATCH] [media] rc: Fix invalid free_region and/or free_irq on probe failure
@ 2012-05-15 1:36 Ben Hutchings
2012-05-15 1:36 ` Ben Hutchings
0 siblings, 1 reply; 2+ messages in thread
From: Ben Hutchings @ 2012-05-15 1:36 UTC (permalink / raw)
To: Mauro Carvalho Chehab; +Cc: linux-media
fintek-cir, ite-cir and nuvoton-cir may try to free an I/O region
and/or IRQ handler that was never allocated after a failure in their
respective probe functions. Add and use separate labels on the
failure path so they will do the right cleanup after each possible
point of failure.
Compile-tested only.
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
drivers/media/rc/fintek-cir.c | 13 ++++++-------
drivers/media/rc/ite-cir.c | 14 ++++++--------
drivers/media/rc/nuvoton-cir.c | 26 ++++++++++++--------------
3 files changed, 24 insertions(+), 29 deletions(-)
diff --git a/drivers/media/rc/fintek-cir.c b/drivers/media/rc/fintek-cir.c
index 4a3a238..6aabf7a 100644
--- a/drivers/media/rc/fintek-cir.c
+++ b/drivers/media/rc/fintek-cir.c
@@ -556,11 +556,11 @@ static int fintek_probe(struct pnp_dev *pdev, const struct pnp_device_id *dev_id
if (request_irq(fintek->cir_irq, fintek_cir_isr, IRQF_SHARED,
FINTEK_DRIVER_NAME, (void *)fintek))
- goto failure;
+ goto failure2;
ret = rc_register_device(rdev);
if (ret)
- goto failure;
+ goto failure3;
device_init_wakeup(&pdev->dev, true);
fintek->rdev = rdev;
@@ -570,12 +570,11 @@ static int fintek_probe(struct pnp_dev *pdev, const struct pnp_device_id *dev_id
return 0;
+failure3:
+ free_irq(fintek->cir_irq, fintek);
+failure2:
+ release_region(fintek->cir_addr, fintek->cir_port_len);
failure:
- if (fintek->cir_irq)
- free_irq(fintek->cir_irq, fintek);
- if (fintek->cir_addr)
- release_region(fintek->cir_addr, fintek->cir_port_len);
-
rc_free_device(rdev);
kfree(fintek);
diff --git a/drivers/media/rc/ite-cir.c b/drivers/media/rc/ite-cir.c
index 0e49c99..36fe5a3 100644
--- a/drivers/media/rc/ite-cir.c
+++ b/drivers/media/rc/ite-cir.c
@@ -1598,24 +1598,22 @@ static int ite_probe(struct pnp_dev *pdev, const struct pnp_device_id
if (request_irq(itdev->cir_irq, ite_cir_isr, IRQF_SHARED,
ITE_DRIVER_NAME, (void *)itdev))
- goto failure;
+ goto failure2;
ret = rc_register_device(rdev);
if (ret)
- goto failure;
+ goto failure3;
itdev->rdev = rdev;
ite_pr(KERN_NOTICE, "driver has been successfully loaded\n");
return 0;
+failure3:
+ free_irq(itdev->cir_irq, itdev);
+failure2:
+ release_region(itdev->cir_addr, itdev->params.io_region_size);
failure:
- if (itdev->cir_irq)
- free_irq(itdev->cir_irq, itdev);
-
- if (itdev->cir_addr)
- release_region(itdev->cir_addr, itdev->params.io_region_size);
-
rc_free_device(rdev);
kfree(itdev);
diff --git a/drivers/media/rc/nuvoton-cir.c b/drivers/media/rc/nuvoton-cir.c
index 8b2c071..dc8a7dd 100644
--- a/drivers/media/rc/nuvoton-cir.c
+++ b/drivers/media/rc/nuvoton-cir.c
@@ -1075,19 +1075,19 @@ static int nvt_probe(struct pnp_dev *pdev, const struct pnp_device_id *dev_id)
if (request_irq(nvt->cir_irq, nvt_cir_isr, IRQF_SHARED,
NVT_DRIVER_NAME, (void *)nvt))
- goto failure;
+ goto failure2;
if (!request_region(nvt->cir_wake_addr,
CIR_IOREG_LENGTH, NVT_DRIVER_NAME))
- goto failure;
+ goto failure3;
if (request_irq(nvt->cir_wake_irq, nvt_cir_wake_isr, IRQF_SHARED,
NVT_DRIVER_NAME, (void *)nvt))
- goto failure;
+ goto failure4;
ret = rc_register_device(rdev);
if (ret)
- goto failure;
+ goto failure5;
device_init_wakeup(&pdev->dev, true);
nvt->rdev = rdev;
@@ -1099,17 +1099,15 @@ static int nvt_probe(struct pnp_dev *pdev, const struct pnp_device_id *dev_id)
return 0;
+failure5:
+ free_irq(nvt->cir_wake_irq, nvt);
+failure4:
+ release_region(nvt->cir_wake_addr, CIR_IOREG_LENGTH);
+failure3:
+ free_irq(nvt->cir_irq, nvt);
+failure2:
+ release_region(nvt->cir_addr, CIR_IOREG_LENGTH);
failure:
- if (nvt->cir_irq)
- free_irq(nvt->cir_irq, nvt);
- if (nvt->cir_addr)
- release_region(nvt->cir_addr, CIR_IOREG_LENGTH);
-
- if (nvt->cir_wake_irq)
- free_irq(nvt->cir_wake_irq, nvt);
- if (nvt->cir_wake_addr)
- release_region(nvt->cir_wake_addr, CIR_IOREG_LENGTH);
-
rc_free_device(rdev);
kfree(nvt);
--
1.7.10
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] [media] rc: Fix invalid free_region and/or free_irq on probe failure
2012-05-15 1:36 [PATCH] [media] rc: Fix invalid free_region and/or free_irq on probe failure Ben Hutchings
@ 2012-05-15 1:36 ` Ben Hutchings
0 siblings, 0 replies; 2+ messages in thread
From: Ben Hutchings @ 2012-05-15 1:36 UTC (permalink / raw)
To: Mauro Carvalho Chehab; +Cc: linux-media
[-- Attachment #1: Type: text/plain, Size: 4638 bytes --]
On Tue, 2012-05-15 at 02:36 +0100, Ben Hutchings wrote:
> fintek-cir, ite-cir and nuvoton-cir may try to free an I/O region
> and/or IRQ handler that was never allocated after a failure in their
> respective probe functions. Add and use separate labels on the
> failure path so they will do the right cleanup after each possible
> point of failure.
>
> Compile-tested only.
>
> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
And this should probably go to stable as well, if you agree it's a valid
fix.
Ben.
> ---
> drivers/media/rc/fintek-cir.c | 13 ++++++-------
> drivers/media/rc/ite-cir.c | 14 ++++++--------
> drivers/media/rc/nuvoton-cir.c | 26 ++++++++++++--------------
> 3 files changed, 24 insertions(+), 29 deletions(-)
>
> diff --git a/drivers/media/rc/fintek-cir.c b/drivers/media/rc/fintek-cir.c
> index 4a3a238..6aabf7a 100644
> --- a/drivers/media/rc/fintek-cir.c
> +++ b/drivers/media/rc/fintek-cir.c
> @@ -556,11 +556,11 @@ static int fintek_probe(struct pnp_dev *pdev, const struct pnp_device_id *dev_id
>
> if (request_irq(fintek->cir_irq, fintek_cir_isr, IRQF_SHARED,
> FINTEK_DRIVER_NAME, (void *)fintek))
> - goto failure;
> + goto failure2;
>
> ret = rc_register_device(rdev);
> if (ret)
> - goto failure;
> + goto failure3;
>
> device_init_wakeup(&pdev->dev, true);
> fintek->rdev = rdev;
> @@ -570,12 +570,11 @@ static int fintek_probe(struct pnp_dev *pdev, const struct pnp_device_id *dev_id
>
> return 0;
>
> +failure3:
> + free_irq(fintek->cir_irq, fintek);
> +failure2:
> + release_region(fintek->cir_addr, fintek->cir_port_len);
> failure:
> - if (fintek->cir_irq)
> - free_irq(fintek->cir_irq, fintek);
> - if (fintek->cir_addr)
> - release_region(fintek->cir_addr, fintek->cir_port_len);
> -
> rc_free_device(rdev);
> kfree(fintek);
>
> diff --git a/drivers/media/rc/ite-cir.c b/drivers/media/rc/ite-cir.c
> index 0e49c99..36fe5a3 100644
> --- a/drivers/media/rc/ite-cir.c
> +++ b/drivers/media/rc/ite-cir.c
> @@ -1598,24 +1598,22 @@ static int ite_probe(struct pnp_dev *pdev, const struct pnp_device_id
>
> if (request_irq(itdev->cir_irq, ite_cir_isr, IRQF_SHARED,
> ITE_DRIVER_NAME, (void *)itdev))
> - goto failure;
> + goto failure2;
>
> ret = rc_register_device(rdev);
> if (ret)
> - goto failure;
> + goto failure3;
>
> itdev->rdev = rdev;
> ite_pr(KERN_NOTICE, "driver has been successfully loaded\n");
>
> return 0;
>
> +failure3:
> + free_irq(itdev->cir_irq, itdev);
> +failure2:
> + release_region(itdev->cir_addr, itdev->params.io_region_size);
> failure:
> - if (itdev->cir_irq)
> - free_irq(itdev->cir_irq, itdev);
> -
> - if (itdev->cir_addr)
> - release_region(itdev->cir_addr, itdev->params.io_region_size);
> -
> rc_free_device(rdev);
> kfree(itdev);
>
> diff --git a/drivers/media/rc/nuvoton-cir.c b/drivers/media/rc/nuvoton-cir.c
> index 8b2c071..dc8a7dd 100644
> --- a/drivers/media/rc/nuvoton-cir.c
> +++ b/drivers/media/rc/nuvoton-cir.c
> @@ -1075,19 +1075,19 @@ static int nvt_probe(struct pnp_dev *pdev, const struct pnp_device_id *dev_id)
>
> if (request_irq(nvt->cir_irq, nvt_cir_isr, IRQF_SHARED,
> NVT_DRIVER_NAME, (void *)nvt))
> - goto failure;
> + goto failure2;
>
> if (!request_region(nvt->cir_wake_addr,
> CIR_IOREG_LENGTH, NVT_DRIVER_NAME))
> - goto failure;
> + goto failure3;
>
> if (request_irq(nvt->cir_wake_irq, nvt_cir_wake_isr, IRQF_SHARED,
> NVT_DRIVER_NAME, (void *)nvt))
> - goto failure;
> + goto failure4;
>
> ret = rc_register_device(rdev);
> if (ret)
> - goto failure;
> + goto failure5;
>
> device_init_wakeup(&pdev->dev, true);
> nvt->rdev = rdev;
> @@ -1099,17 +1099,15 @@ static int nvt_probe(struct pnp_dev *pdev, const struct pnp_device_id *dev_id)
>
> return 0;
>
> +failure5:
> + free_irq(nvt->cir_wake_irq, nvt);
> +failure4:
> + release_region(nvt->cir_wake_addr, CIR_IOREG_LENGTH);
> +failure3:
> + free_irq(nvt->cir_irq, nvt);
> +failure2:
> + release_region(nvt->cir_addr, CIR_IOREG_LENGTH);
> failure:
> - if (nvt->cir_irq)
> - free_irq(nvt->cir_irq, nvt);
> - if (nvt->cir_addr)
> - release_region(nvt->cir_addr, CIR_IOREG_LENGTH);
> -
> - if (nvt->cir_wake_irq)
> - free_irq(nvt->cir_wake_irq, nvt);
> - if (nvt->cir_wake_addr)
> - release_region(nvt->cir_wake_addr, CIR_IOREG_LENGTH);
> -
> rc_free_device(rdev);
> kfree(nvt);
>
--
Ben Hutchings
The two most common things in the universe are hydrogen and stupidity.
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 828 bytes --]
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2012-05-15 1:36 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2012-05-15 1:36 [PATCH] [media] rc: Fix invalid free_region and/or free_irq on probe failure Ben Hutchings
2012-05-15 1:36 ` Ben Hutchings
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).