From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
To: linux-input@vger.kernel.org
Cc: Marge Yang <Marge.Yang@tw.synaptics.com>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
linux-kernel@vger.kernel.org, stable@vger.kernel.org
Subject: [PATCH v2 05/20] Input: rmi4 - fix memory leak in rmi_set_attn_data()
Date: Mon, 4 May 2026 21:59:35 -0700 [thread overview]
Message-ID: <20260505045952.1570713-5-dmitry.torokhov@gmail.com> (raw)
In-Reply-To: <20260505045952.1570713-1-dmitry.torokhov@gmail.com>
kfifo_put() returns 0 if the FIFO is full. In this case, we must
free the memory allocated for the attention data to avoid a leak.
Fixes: b908d3cd812a ("Input: synaptics-rmi4 - allow to add attention data")
Cc: stable@vger.kernel.org
Assisted-by: Gemini:gemini-3.1-pro
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
---
drivers/input/rmi4/rmi_driver.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/input/rmi4/rmi_driver.c b/drivers/input/rmi4/rmi_driver.c
index 75949fb1a922..d873c7f08e42 100644
--- a/drivers/input/rmi4/rmi_driver.c
+++ b/drivers/input/rmi4/rmi_driver.c
@@ -183,7 +183,11 @@ void rmi_set_attn_data(struct rmi_device *rmi_dev, unsigned long irq_status,
attn_data.size = size;
attn_data.data = fifo_data;
- kfifo_put(&drvdata->attn_fifo, attn_data);
+ if (!kfifo_put(&drvdata->attn_fifo, attn_data)) {
+ dev_warn_ratelimited(&rmi_dev->dev,
+ "Failed to enqueue attention data, FIFO full\n");
+ kfree(fifo_data);
+ }
}
EXPORT_SYMBOL_GPL(rmi_set_attn_data);
--
2.54.0.545.g6539524ca2-goog
next prev parent reply other threads:[~2026-05-05 5:00 UTC|newest]
Thread overview: 20+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-05-05 4:59 [PATCH v2 01/20] Input: rmi4 - fix register descriptor address calculation Dmitry Torokhov
2026-05-05 4:59 ` [PATCH v2 02/20] Input: rmi4 - refactor register descriptor parsing Dmitry Torokhov
2026-05-05 4:59 ` [PATCH v2 03/20] Input: rmi4 - fix type overflow in register counts Dmitry Torokhov
2026-05-05 4:59 ` [PATCH v2 04/20] Input: rmi4 - fix num_subpackets overflow in register descriptor Dmitry Torokhov
2026-05-05 4:59 ` Dmitry Torokhov [this message]
2026-05-05 4:59 ` [PATCH v2 06/20] Input: rmi4 - iterative IRQ handler Dmitry Torokhov
2026-05-05 4:59 ` [PATCH v2 07/20] Input: rmi4 - fix bit count in bitmap_copy() Dmitry Torokhov
2026-05-05 4:59 ` [PATCH v2 08/20] Input: rmi4 - fix limit in rmi_register_desc_has_subpacket() Dmitry Torokhov
2026-05-05 4:59 ` [PATCH v2 09/20] Input: rmi4 - use local presence map in rmi_read_register_desc() Dmitry Torokhov
2026-05-05 4:59 ` [PATCH v2 10/20] Input: rmi4 - refactor function allocation and registration Dmitry Torokhov
2026-05-05 4:59 ` [PATCH v2 11/20] Input: rmi4 - use kzalloc_flex() for struct rmi_function Dmitry Torokhov
2026-05-05 4:59 ` [PATCH v2 12/20] Input: rmi4 - refactor F12 probe function Dmitry Torokhov
2026-05-05 4:59 ` [PATCH v2 13/20] Input: rmi4 - change reg_size type to u32 Dmitry Torokhov
2026-05-05 4:59 ` [PATCH v2 14/20] Input: rmi4 - use unaligned access helpers in F12 Dmitry Torokhov
2026-05-05 4:59 ` [PATCH v2 15/20] Input: rmi4 - use flexible array member for IRQ masks " Dmitry Torokhov
2026-05-05 4:59 ` [PATCH v2 16/20] Input: rmi4 - use devm_kmalloc for F12 data packet buffer Dmitry Torokhov
2026-05-05 4:59 ` [PATCH v2 17/20] Input: rmi4 - use sizeof(*ptr) and idiomatic checks in f12 allocators Dmitry Torokhov
2026-05-05 4:59 ` [PATCH v2 18/20] Input: rmi4 - simplify size calculations in F12 Dmitry Torokhov
2026-05-05 4:59 ` [PATCH v2 19/20] Input: rmi4 - propagate proper error code in F12 sensor tuning Dmitry Torokhov
2026-05-05 4:59 ` [PATCH v2 20/20] Input: rmi4 - update formatting in F12 Dmitry Torokhov
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260505045952.1570713-5-dmitry.torokhov@gmail.com \
--to=dmitry.torokhov@gmail.com \
--cc=Marge.Yang@tw.synaptics.com \
--cc=gregkh@linuxfoundation.org \
--cc=linux-input@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox