Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f27b853e authored by Ben Hutchings's avatar Ben Hutchings Committed by Mauro Carvalho Chehab
Browse files

[media] rc: Fix invalid free_region and/or free_irq on probe failure 



fintek-cir, ite-cir and nuvoton-cir may try to free an I/O region
and/or IRQ handler that was never allocated after a failure in their
respective probe functions.  Add and use separate labels on the
failure path so they will do the right cleanup after each possible
point of failure.

Compile-tested only.

Signed-off-by: default avatarBen Hutchings <ben@decadent.org.uk>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@redhat.com>
parent 81cda577

drivers/media/rc/fintek-cir.c

+6 −7
Original line number Diff line number Diff line
@@ -556,11 +556,11 @@ static int fintek_probe(struct pnp_dev *pdev, const struct pnp_device_id *dev_id 


	if (request_irq(fintek->cir_irq, fintek_cir_isr, IRQF_SHARED,

			FINTEK_DRIVER_NAME, (void *)fintek))

		goto failure;

		goto failure2;



	ret = rc_register_device(rdev);

	if (ret)

		goto failure;

		goto failure3;



	device_init_wakeup(&pdev->dev, true);

	fintek->rdev = rdev;
@@ -570,12 +570,11 @@ static int fintek_probe(struct pnp_dev *pdev, const struct pnp_device_id *dev_id 


	return 0;



failure:

	if (fintek->cir_irq)

failure3:

	free_irq(fintek->cir_irq, fintek);

	if (fintek->cir_addr)

failure2:

	release_region(fintek->cir_addr, fintek->cir_port_len);



failure:

	rc_free_device(rdev);

	kfree(fintek);

drivers/media/rc/ite-cir.c

+6 −8
Original line number Diff line number Diff line
@@ -1598,24 +1598,22 @@ static int ite_probe(struct pnp_dev *pdev, const struct pnp_device_id 


	if (request_irq(itdev->cir_irq, ite_cir_isr, IRQF_SHARED,

			ITE_DRIVER_NAME, (void *)itdev))

		goto failure;

		goto failure2;



	ret = rc_register_device(rdev);

	if (ret)

		goto failure;

		goto failure3;



	itdev->rdev = rdev;

	ite_pr(KERN_NOTICE, "driver has been successfully loaded\n");



	return 0;



failure:

	if (itdev->cir_irq)

failure3:

	free_irq(itdev->cir_irq, itdev);



	if (itdev->cir_addr)

failure2:

	release_region(itdev->cir_addr, itdev->params.io_region_size);



failure:

	rc_free_device(rdev);

	kfree(itdev);

drivers/media/rc/nuvoton-cir.c

+12 −14
Original line number Diff line number Diff line
@@ -1075,19 +1075,19 @@ static int nvt_probe(struct pnp_dev *pdev, const struct pnp_device_id *dev_id) 


	if (request_irq(nvt->cir_irq, nvt_cir_isr, IRQF_SHARED,

			NVT_DRIVER_NAME, (void *)nvt))

		goto failure;

		goto failure2;



	if (!request_region(nvt->cir_wake_addr,

			    CIR_IOREG_LENGTH, NVT_DRIVER_NAME))

		goto failure;

		goto failure3;



	if (request_irq(nvt->cir_wake_irq, nvt_cir_wake_isr, IRQF_SHARED,

			NVT_DRIVER_NAME, (void *)nvt))

		goto failure;

		goto failure4;



	ret = rc_register_device(rdev);

	if (ret)

		goto failure;

		goto failure5;



	device_init_wakeup(&pdev->dev, true);

	nvt->rdev = rdev;
@@ -1099,17 +1099,15 @@ static int nvt_probe(struct pnp_dev *pdev, const struct pnp_device_id *dev_id) 


	return 0;



failure:

	if (nvt->cir_irq)

		free_irq(nvt->cir_irq, nvt);

	if (nvt->cir_addr)

		release_region(nvt->cir_addr, CIR_IOREG_LENGTH);



	if (nvt->cir_wake_irq)

failure5:

	free_irq(nvt->cir_wake_irq, nvt);

	if (nvt->cir_wake_addr)

failure4:

	release_region(nvt->cir_wake_addr, CIR_IOREG_LENGTH);



failure3:

	free_irq(nvt->cir_irq, nvt);

failure2:

	release_region(nvt->cir_addr, CIR_IOREG_LENGTH);

failure:

	rc_free_device(rdev);

	kfree(nvt);