[PATCH 1/3] parport: fix error handling

[PATCH 1/3] parport: fix error handling

[Sudip Mukherjee]

After registering the device if exclusive access fails for any reason
then we need to unregister the device to remove all references.

Signed-off-by: Sudip Mukherjee <sudip@vectorindia.org>
---
 drivers/parport/share.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/parport/share.c b/drivers/parport/share.c
index 8067f54..d8079e3 100644
--- a/drivers/parport/share.c
+++ b/drivers/parport/share.c
@@ -907,7 +907,8 @@ parport_register_dev_model(struct parport *port, const char *name,
 			spin_unlock(&port->physport->pardevice_lock);
 			pr_debug("%s: cannot grant exclusive access for device %s\n",
 				 port->name, name);
-			goto err_put_dev;
+			device_unregister(&par_dev->dev);
+			goto err_put_port;
 		}
 		port->flags |= PARPORT_FLAG_EXCL;
 	}
-- 
1.8.1.2

[PATCH 2/3] parport: fix memory leak

[Sudip Mukherjee]

After the reference count becomes 0 when put_device() is called, it will
execute the release callback where we are freeing all the allocated
memory associated with the device. We missed freeing par_dev->state.

Signed-off-by: Sudip Mukherjee <sudip@vectorindia.org>
---
 drivers/parport/share.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/parport/share.c b/drivers/parport/share.c
index d8079e3..1efec44 100644
--- a/drivers/parport/share.c
+++ b/drivers/parport/share.c
@@ -816,6 +816,7 @@ static void free_pardevice(struct device *dev)
 	struct pardevice *par_dev = to_pardevice(dev);
 
 	kfree(par_dev->name);
+	kfree(par_dev->state);
 	kfree(par_dev);
 }
 
-- 
1.8.1.2

[PATCH 3/3] parport: fix freeing freed memory

[Sudip Mukherjee]

After the reference count becomes 0 when put_device() is called, it will
execute the release callback where we are freeing all the allocated
memory associated with the device. So if we just continue on the error
path then we are again freeing devname and trying to dereference par_dev
which has already been free-ed in the release callback.

Signed-off-by: Sudip Mukherjee <sudip@vectorindia.org>
---
 drivers/parport/share.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/parport/share.c b/drivers/parport/share.c
index 1efec44..c02b5f2 100644
--- a/drivers/parport/share.c
+++ b/drivers/parport/share.c
@@ -892,8 +892,10 @@ parport_register_dev_model(struct parport *port, const char *name,
 	par_dev->dev.release = free_pardevice;
 	par_dev->devmodel = true;
 	ret = device_register(&par_dev->dev);
-	if (ret)
-		goto err_put_dev;
+	if (ret) {
+		put_device(&par_dev->dev);
+		goto err_put_port;
+	}
 
 	/* Chain this onto the list */
 	par_dev->prev = NULL;
@@ -940,8 +942,6 @@ parport_register_dev_model(struct parport *port, const char *name,
 
 	return par_dev;
 
-err_put_dev:
-	put_device(&par_dev->dev);
 err_free_devname:
 	kfree(devname);
 err_free_par_dev:
-- 
1.8.1.2

Re: [PATCH 1/3] parport: fix error handling

[Sudip Mukherjee]

On Mon, Jun 15, 2015 at 08:05:49PM +0530, Sudip Mukherjee wrote:

Hi Greg,
These were posted only few days before the merge window.
Can these be considered for linux-next now so that it gets some testing..
I have it as a pull request also for your convenience.

regards
sudip

The following changes since commit d770e558e21961ad6cfdf0ff7df0eb5d7d4f0754:

  Linux 4.2-rc1 (2015-07-05 11:01:52 -0700)

are available in the git repository at:

  https://github.com/sudipm-mukherjee/parport.git master

for you to fetch changes up to 209f7b71f72333ae076aa231fe71578f97a5c275:

  parport: fix freeing freed memory (2015-07-07 13:59:19 +0530)

----------------------------------------------------------------
Sudip Mukherjee (3):
      parport: fix error handling
      parport: fix memory leak
      parport: fix freeing freed memory

 drivers/parport/share.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)