Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4f84e2c3 authored by Bingzhe Cai's avatar Bingzhe Cai
Browse files

input: sensors: fix incorrect use of input_free_device() 



Input_free_device() should only be used if input_register_device()
was not called yet or if it failed, some sensor drivers does not
use this correctly, this may cause null pointer exception when
unbinding driver or binding fails.

Change-Id: I04d455dd9cd59ab76be7d621815ad70668c0bac1
Signed-off-by: default avatarBingzhe Cai <bingzhec@codeaurora.org>
parent f7d25bdf

drivers/input/misc/bma2x2.c

+7 −25
Original line number Diff line number Diff line
@@ -7161,7 +7161,7 @@ static int bma2x2_probe(struct i2c_client *client, 
	atomic_set(&data->delay, BMA2X2_MAX_DELAY);

	atomic_set(&data->enable, 0);



	dev = input_allocate_device();

	dev = devm_input_allocate_device(&client->dev);

	if (!dev) {

		dev_err(&client->dev,

			"Cannot allocate input device\n");
@@ -7169,12 +7169,12 @@ static int bma2x2_probe(struct i2c_client *client, 
		goto free_irq_exit;

	}



	dev_interrupt = input_allocate_device();

	dev_interrupt = devm_input_allocate_device(&client->dev);

	if (!dev_interrupt) {

		dev_err(&client->dev,

			"Cannot allocate input interrupt device\n");

		err = -ENOMEM;

		goto free_input_dev_exit;

		goto free_irq_exit;

	}



	/* only value events reported */
@@ -7190,7 +7190,7 @@ static int bma2x2_probe(struct i2c_client *client, 
	if (err < 0) {

		dev_err(&client->dev,

			"Cannot register input device\n");

		goto free_input_interrupt_dev_exit;

		goto free_irq_exit;

	}



	/* all interrupt generated events are moved to interrupt input devices*/
@@ -7218,7 +7218,7 @@ static int bma2x2_probe(struct i2c_client *client, 
	if (err < 0) {

		dev_err(&client->dev,

			"Cannot register input interrupt device\n");

		goto unregister_input_dev_exit;

		goto free_irq_exit;

	}



	data->dev_interrupt = dev_interrupt;
@@ -7230,7 +7230,7 @@ static int bma2x2_probe(struct i2c_client *client, 
		err = PTR_ERR(data->g_sensor_class);

		data->g_sensor_class = NULL;

		dev_err(&client->dev, "could not allocate g_sensor_class\n");

		goto unregister_input_interrupt_dev_exit;

		goto free_irq_exit;

	}



	data->g_sensor_dev = device_create(data->g_sensor_class,
@@ -7394,16 +7394,6 @@ destroy_g_sensor_class_exit: 
	class_destroy(data->g_sensor_class);

#endif



#if defined(CONFIG_SIG_MOTION) || defined(CONFIG_DOUBLE_TAP)

unregister_input_interrupt_dev_exit:

#endif

	input_unregister_device(dev_interrupt);

unregister_input_dev_exit:

	input_unregister_device(dev);

free_input_interrupt_dev_exit:

	input_free_device(dev_interrupt);

free_input_dev_exit:

	input_free_device(dev);

free_irq_exit:

disable_power_exit:

	bma2x2_power_ctl(data, false);
@@ -7472,17 +7462,9 @@ static int bma2x2_remove(struct i2c_client *client) 


	bma2x2_sig_motion_disable(data);



	if (data->dev_interrupt) {

		input_unregister_device(data->dev_interrupt);

		input_free_device(data->dev_interrupt);

	}



	if (data->input) {

	if (data->input)

		sysfs_remove_group(&data->input->dev.kobj,

				&bma2x2_attribute_group);

		input_unregister_device(data->input);

		input_free_device(data->input);

	}



	bma2x2_set_enable(&client->dev, 0);

	bma2x2_power_deinit(data);

drivers/input/misc/cm36283.c

+4 −16
Original line number Diff line number Diff line
@@ -1316,7 +1316,7 @@ static int lightsensor_setup(struct cm36283_info *lpi) 
	int ret;

	int range;



	lpi->ls_input_dev = input_allocate_device();

	lpi->ls_input_dev = devm_input_allocate_device(&lpi->i2c_client->dev);

	if (!lpi->ls_input_dev) {

		pr_err(

			"[LS][CM36283 error]%s: could not allocate ls input device\n",
@@ -1337,10 +1337,7 @@ static int lightsensor_setup(struct cm36283_info *lpi) 
		goto err_free_ls_input_device;

	}



	return ret;



err_free_ls_input_device:

	input_free_device(lpi->ls_input_dev);

	return ret;

}
@@ -1348,7 +1345,7 @@ static int psensor_setup(struct cm36283_info *lpi) 
{

	int ret;



	lpi->ps_input_dev = input_allocate_device();

	lpi->ps_input_dev = devm_input_allocate_device(&lpi->i2c_client->dev);

	if (!lpi->ps_input_dev) {

		pr_err(

			"[PS][CM36283 error]%s: could not allocate ps input device\n",
@@ -1368,10 +1365,7 @@ static int psensor_setup(struct cm36283_info *lpi) 
		goto err_free_ps_input_device;

	}



	return ret;



err_free_ps_input_device:

	input_free_device(lpi->ps_input_dev);

	return ret;

}
@@ -1704,14 +1698,14 @@ static int cm36283_probe(struct i2c_client *client, 
	if (ret < 0) {

		pr_err("[PS][CM36283 error]%s: psensor_setup error!!\n",

			__func__);

		goto err_psensor_setup;

		goto err_lightsensor_setup;

	}



	ret = create_sysfs_interfaces(&lpi->ls_input_dev->dev, light_attr,

			ARRAY_SIZE(light_attr));

	if (ret < 0) {

		dev_err(&client->dev, "failed to create sysfs\n");

		goto err_input_cleanup;

		goto err_lightsensor_setup;

	}



	ret = create_sysfs_interfaces(&lpi->ps_input_dev->dev, proximity_attr,
@@ -1753,12 +1747,6 @@ err_proximity_sysfs_cleanup: 
err_light_sysfs_cleanup:

	remove_sysfs_interfaces(&lpi->ls_input_dev->dev, light_attr,

			ARRAY_SIZE(light_attr));

err_input_cleanup:

	input_unregister_device(lpi->ps_input_dev);

	input_free_device(lpi->ps_input_dev);

err_psensor_setup:

	input_unregister_device(lpi->ls_input_dev);

	input_free_device(lpi->ls_input_dev);

err_lightsensor_setup:

err_cm36283_setup:

	cm36283_power_set(lpi, false);

drivers/input/misc/lis3dh_acc.c

+3 −14
Original line number Diff line number Diff line
@@ -1837,7 +1837,7 @@ static int lis3dh_acc_input_init(struct lis3dh_acc_data *acc) 


	if (!acc->pdata->enable_int)

		INIT_DELAYED_WORK(&acc->input_work, lis3dh_acc_input_work_func);

	acc->input_dev = input_allocate_device();

	acc->input_dev = devm_input_allocate_device(&acc->client->dev);

	if (!acc->input_dev) {

		err = -ENOMEM;

		dev_err(&acc->client->dev, "input device allocation failed\n");
@@ -1876,23 +1876,15 @@ static int lis3dh_acc_input_init(struct lis3dh_acc_data *acc) 
		dev_err(&acc->client->dev,

				"unable to register input device %s\n",

				acc->input_dev->name);

		goto err1;

		goto err0;

	}



	return 0;



err1:

	input_free_device(acc->input_dev);

err0:

	return err;

}



static void lis3dh_acc_input_cleanup(struct lis3dh_acc_data *acc)

{

	input_unregister_device(acc->input_dev);

	input_free_device(acc->input_dev);

}



static int lis3dh_pinctrl_init(struct lis3dh_acc_data *acc)

{

	struct i2c_client *client = acc->client;
@@ -2173,7 +2165,7 @@ static int lis3dh_acc_probe(struct i2c_client *client, 
	if (err < 0) {

		dev_err(&client->dev,

		   "device LIS3DH_ACC_DEV_NAME sysfs register failed\n");

		goto err_input_cleanup;

		goto err_power_off;

	}



	acc->cdev = lis3dh_acc_cdev;
@@ -2244,8 +2236,6 @@ err_unreg_sensor_class: 
	sensors_classdev_unregister(&acc->cdev);

err_remove_sysfs_int:

	remove_sysfs_interfaces(&client->dev);

err_input_cleanup:

	lis3dh_acc_input_cleanup(acc);

err_power_off:

	lis3dh_acc_device_power_off(acc);

err_regulator_init:
@@ -2275,7 +2265,6 @@ static int lis3dh_acc_remove(struct i2c_client *client) 
		free_irq(acc->irq2, acc);



	sensors_classdev_unregister(&acc->cdev);

	lis3dh_acc_input_cleanup(acc);

	lis3dh_acc_config_regulator(acc, false);

	remove_sysfs_interfaces(&client->dev);

drivers/input/misc/mma8x5x.c

+4 −9
Original line number Diff line number Diff line
@@ -31,6 +31,7 @@ 
#include <linux/regulator/consumer.h>

#include <linux/of_gpio.h>

#include <linux/irq.h>

#include <linux/interrupt.h>



#define ACCEL_INPUT_DEV_NAME		"accelerometer"

#define MMA8451_ID			0x1A
@@ -916,7 +917,7 @@ static int mma8x5x_probe(struct i2c_client *client, 
	} else {

		INIT_DELAYED_WORK(&pdata->dwork, mma8x5x_dev_poll);

	}

	idev = input_allocate_device();

	idev = devm_input_allocate_device(&client->dev);

	if (!idev) {

		result = -ENOMEM;

		dev_err(&client->dev, "alloc input device failed!\n");
@@ -933,7 +934,7 @@ static int mma8x5x_probe(struct i2c_client *client, 
	result = input_register_device(idev);

	if (result) {

		dev_err(&client->dev, "register input device failed!\n");

		goto err_register_device;

		goto err_alloc_poll_device;

	}

	pdata->idev = idev;
@@ -941,7 +942,7 @@ static int mma8x5x_probe(struct i2c_client *client, 
	if (result) {

		dev_err(&client->dev, "create device file failed!\n");

		result = -EINVAL;

		goto err_create_sysfs;

		goto err_alloc_poll_device;

	}

	pdata->cdev = sensors_cdev;

	pdata->cdev.min_delay = POLL_INTERVAL_MIN * 1000;
@@ -961,10 +962,6 @@ static int mma8x5x_probe(struct i2c_client *client, 
	return 0;

err_create_class_sysfs:

	sysfs_remove_group(&idev->dev.kobj, &mma8x5x_attr_group);

err_create_sysfs:

	input_unregister_device(idev);

err_register_device:

	input_free_device(idev);

err_alloc_poll_device:

err_register_irq:

	if (pdata->use_int)
@@ -994,8 +991,6 @@ static int mma8x5x_remove(struct i2c_client *client) 
			if (gpio_is_valid(pdata->int_pin))

				gpio_free(pdata->int_pin);

		}

		input_unregister_device(idev);

		input_free_device(idev);

		kfree(pdata);

	}

	mma8x5x_config_regulator(client, 0);

drivers/input/misc/mpu3050.c

+2 −7
Original line number Diff line number Diff line
@@ -45,7 +45,6 @@ 
#include <linux/input/mpu3050.h>

#include <linux/regulator/consumer.h>

#include <linux/of_gpio.h>

#include <mach/gpiomux.h>



#define	MPU3050_DEV_NAME_GYRO	"gyroscope"
@@ -666,7 +665,7 @@ static int mpu3050_probe(struct i2c_client *client, 
	u32 i;



	sensor = kzalloc(sizeof(struct mpu3050_sensor), GFP_KERNEL);

	idev = input_allocate_device();

	idev = devm_input_allocate_device(&client->dev);

	if (!sensor || !idev) {

		dev_err(&client->dev, "failed to allocate driver data\n");

		error = -ENOMEM;
@@ -822,7 +821,7 @@ static int mpu3050_probe(struct i2c_client *client, 
	error = create_sysfs_interfaces(&idev->dev);

	if (error < 0) {

		dev_err(&client->dev, "failed to create sysfs\n");

		goto err_input_cleanup;

		goto err_free_irq;

	}



	pm_runtime_enable(&client->dev);
@@ -830,8 +829,6 @@ static int mpu3050_probe(struct i2c_client *client, 


	return 0;



err_input_cleanup:

	input_unregister_device(idev);

err_free_irq:

	if (client->irq > 0)

		free_irq(client->irq, sensor);
@@ -844,7 +841,6 @@ err_pm_set_suspended: 
err_class_sysfs:

	sensors_classdev_unregister(&sensor->cdev);

err_free_mem:

	input_free_device(idev);

	kfree(sensor);

	return error;

}
@@ -868,7 +864,6 @@ static int mpu3050_remove(struct i2c_client *client) 
	remove_sysfs_interfaces(&client->dev);

	if (gpio_is_valid(sensor->enable_gpio))

		gpio_free(sensor->enable_gpio);

	input_unregister_device(sensor->idev);



	kfree(sensor);