Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit da48db66 authored by Jarod Wilson's avatar Jarod Wilson Committed by Mauro Carvalho Chehab
Browse files

V4L/DVB: IR/imon: remove bad ir_input_dev use 



The ir_input_dev gets filled in by __ir_input_register, the one
allocated in imon_init_idev was being overwritten by the correct one
shortly after it was initialized (ultimately resulting in a memory
leak). Additionally, there was an ill-advised memcpy into that
extraneous ir_input_dev which gets fixed by this.

Ill-advised memcpy pointed out by Dmitry Torokhov, bad usage of
ir_input_dev pointed out by Maxim Levitsky.

Signed-off-by: default avatarJarod Wilson <jarod@redhat.com>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@redhat.com>
parent 20cd1959

drivers/media/IR/imon.c

+0 −15
Original line number Diff line number Diff line
@@ -87,7 +87,6 @@ static ssize_t lcd_write(struct file *file, const char *buf, 
struct imon_context {

	struct device *dev;

	struct ir_dev_props *props;

	struct ir_input_dev *ir;

	/* Newer devices have two interfaces */

	struct usb_device *usbdev_intf0;

	struct usb_device *usbdev_intf1;
@@ -1656,7 +1655,6 @@ static struct input_dev *imon_init_idev(struct imon_context *ictx) 
{

	struct input_dev *idev;

	struct ir_dev_props *props;

	struct ir_input_dev *ir;

	int ret, i;



	idev = input_allocate_device();
@@ -1671,12 +1669,6 @@ static struct input_dev *imon_init_idev(struct imon_context *ictx) 
		goto props_alloc_failed;

	}



	ir = kzalloc(sizeof(struct ir_input_dev), GFP_KERNEL);

	if (!ir) {

		dev_err(ictx->dev, "remote ir input dev allocation failed\n");

		goto ir_dev_alloc_failed;

	}



	snprintf(ictx->name_idev, sizeof(ictx->name_idev),

		 "iMON Remote (%04x:%04x)", ictx->vendor, ictx->product);

	idev->name = ictx->name_idev;
@@ -1706,14 +1698,9 @@ static struct input_dev *imon_init_idev(struct imon_context *ictx) 
	props->change_protocol = imon_ir_change_protocol;

	ictx->props = props;



	ictx->ir = ir;

	memcpy(&ir->dev, ictx->dev, sizeof(struct device));



	usb_to_input_id(ictx->usbdev_intf0, &idev->id);

	idev->dev.parent = ictx->dev;



	input_set_drvdata(idev, ir);



	ret = ir_input_register(idev, RC_MAP_IMON_PAD, props, MOD_NAME);

	if (ret < 0) {

		dev_err(ictx->dev, "remote input dev register failed\n");
@@ -1723,8 +1710,6 @@ static struct input_dev *imon_init_idev(struct imon_context *ictx) 
	return idev;



idev_register_failed:

	kfree(ir);

ir_dev_alloc_failed:

	kfree(props);

props_alloc_failed:

	input_free_device(idev);