Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 88914bdf authored by Jarod Wilson's avatar Jarod Wilson Committed by Mauro Carvalho Chehab
Browse files

[media] staging/lirc: fix mem leaks and ptr err usage 



When the lirc drivers were converted over to using memdup_user, I
mistakenly also removed corresponding calls to kfree. Add those back. I
also screwed up on the allocation error check in lirc_serial, using if
(PTR_ERR()) instead of if (IS_ERR()), which broke transmit.

Reported-by: default avatarJiri Fojtasek <jiri.fojtasek@hlohovec.net>
Signed-off-by: default avatarJarod Wilson <jarod@redhat.com>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@redhat.com>
parent 559d162e

drivers/staging/lirc/lirc_imon.c

+1 −0
Original line number Diff line number Diff line
@@ -447,6 +447,7 @@ static ssize_t vfd_write(struct file *file, const char *buf, 


exit:

	mutex_unlock(&context->ctx_lock);

	kfree(data_buf);



	return (!retval) ? n_bytes : retval;

}

drivers/staging/lirc/lirc_it87.c

+1 −0
Original line number Diff line number Diff line
@@ -232,6 +232,7 @@ static ssize_t lirc_write(struct file *file, const char *buf, 
		i++;

	}

	terminate_send(tx_buf[i - 1]);

	kfree(tx_buf);

	return n;

}

drivers/staging/lirc/lirc_parallel.c

+14 −5
Original line number Diff line number Diff line
@@ -376,6 +376,7 @@ static ssize_t lirc_write(struct file *filep, const char *buf, size_t n, 
	unsigned long flags;

	int counttimer;

	int *wbuf;

	ssize_t ret;



	if (!is_claimed)

		return -EBUSY;
@@ -393,8 +394,10 @@ static ssize_t lirc_write(struct file *filep, const char *buf, size_t n, 
	if (timer == 0) {

		/* try again if device is ready */

		timer = init_lirc_timer();

		if (timer == 0)

			return -EIO;

		if (timer == 0) {

			ret = -EIO;

			goto out;

		}

	}



	/* adjust values from usecs */
@@ -420,7 +423,8 @@ static ssize_t lirc_write(struct file *filep, const char *buf, size_t n, 
			if (check_pselecd && (in(1) & LP_PSELECD)) {

				lirc_off();

				local_irq_restore(flags);

				return -EIO;

				ret = -EIO;

				goto out;

			}

		} while (counttimer < wbuf[i]);

		i++;
@@ -436,7 +440,8 @@ static ssize_t lirc_write(struct file *filep, const char *buf, size_t n, 
			level = newlevel;

			if (check_pselecd && (in(1) & LP_PSELECD)) {

				local_irq_restore(flags);

				return -EIO;

				ret = -EIO;

				goto out;

			}

		} while (counttimer < wbuf[i]);

		i++;
@@ -445,7 +450,11 @@ static ssize_t lirc_write(struct file *filep, const char *buf, size_t n, 
#else

	/* place code that handles write without external timer here */

#endif

	return n;

	ret = n;

out:

	kfree(wbuf);



	return ret;

}



static unsigned int lirc_poll(struct file *file, poll_table *wait)

drivers/staging/lirc/lirc_sasem.c

+1 −0
Original line number Diff line number Diff line
@@ -448,6 +448,7 @@ static ssize_t vfd_write(struct file *file, const char *buf, 
exit:



	mutex_unlock(&context->ctx_lock);

	kfree(data_buf);



	return (!retval) ? n_bytes : retval;

}

drivers/staging/lirc/lirc_serial.c

+2 −1
Original line number Diff line number Diff line
@@ -966,7 +966,7 @@ static ssize_t lirc_write(struct file *file, const char *buf, 
	if (n % sizeof(int) || count % 2 == 0)

		return -EINVAL;

	wbuf = memdup_user(buf, n);

	if (PTR_ERR(wbuf))

	if (IS_ERR(wbuf))

		return PTR_ERR(wbuf);

	spin_lock_irqsave(&hardware[type].lock, flags);

	if (type == LIRC_IRDEO) {
@@ -981,6 +981,7 @@ static ssize_t lirc_write(struct file *file, const char *buf, 
	}

	off();

	spin_unlock_irqrestore(&hardware[type].lock, flags);

	kfree(wbuf);

	return n;

}