iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

wlcore: fix usage of platform_device_add_data()

Browse Source 
Coverity CID 986698 reports leakage of struct wlcore_platdev_data in the
probe functions of both the SPI/SDIO interfaces. The structure passed to
platform_device_add_data() is dynamically allocated and only freed in the
error paths, however, platform_device_add_data() adds a copy of the platform
specific data to the device. Move the temporary struct that is kmemdup'ed
to the stack. This issue exists since afb43e6d (wlcore: remove if_ops from
platform_data).

Signed-off-by: Christian Engelmayer <cengelma@gmx.at>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
This commit is contained in:
Christian Engelmayer 2014-04-24 22:35:56 +02:00 committed by John W. Linville
parent 329d6e299f
commit 4c10416236
2 changed files with 20 additions and 31 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
drivers/net/wireless/ti/wlcore/sdio.c
View File

@ -217,7 +217,7 @@ static struct wl1271_if_operations sdio_ops = {
static int wl1271_probe(struct sdio_func *func, static int wl1271_probe(struct sdio_func *func,
const struct sdio_device_id *id) const struct sdio_device_id *id)
{ {
struct wlcore_platdev_data *pdev_data; struct wlcore_platdev_data pdev_data;
struct wl12xx_sdio_glue *glue; struct wl12xx_sdio_glue *glue;
struct resource res[1]; struct resource res[1];
mmc_pm_flag_t mmcflags; mmc_pm_flag_t mmcflags;
@ -228,16 +228,13 @@ static int wl1271_probe(struct sdio_func *func,
if (func->num != 0x02) if (func->num != 0x02)
return -ENODEV; return -ENODEV;
pdev_data = kzalloc(sizeof(*pdev_data), GFP_KERNEL); memset(&pdev_data, 0x00, sizeof(pdev_data));
if (!pdev_data) pdev_data.if_ops = &sdio_ops;
goto out;
pdev_data->if_ops = &sdio_ops;
glue = kzalloc(sizeof(*glue), GFP_KERNEL); glue = kzalloc(sizeof(*glue), GFP_KERNEL);
if (!glue) { if (!glue) {
dev_err(&func->dev, "can't allocate glue\n"); dev_err(&func->dev, "can't allocate glue\n");
goto out_free_pdev_data; goto out;
} }
glue->dev = &func->dev; glue->dev = &func->dev;
@ -248,9 +245,9 @@ static int wl1271_probe(struct sdio_func *func,
/* Use block mode for transferring over one block size of data */ /* Use block mode for transferring over one block size of data */
func->card->quirks |= MMC_QUIRK_BLKSZ_FOR_BYTE_MODE; func->card->quirks |= MMC_QUIRK_BLKSZ_FOR_BYTE_MODE;
pdev_data->pdata = wl12xx_get_platform_data(); pdev_data.pdata = wl12xx_get_platform_data();
if (IS_ERR(pdev_data->pdata)) { if (IS_ERR(pdev_data.pdata)) {
ret = PTR_ERR(pdev_data->pdata); ret = PTR_ERR(pdev_data.pdata);
dev_err(glue->dev, "missing wlan platform data: %d\n", ret); dev_err(glue->dev, "missing wlan platform data: %d\n", ret);
goto out_free_glue; goto out_free_glue;
} }
@ -260,7 +257,7 @@ static int wl1271_probe(struct sdio_func *func,
dev_dbg(glue->dev, "sdio PM caps = 0x%x\n", mmcflags); dev_dbg(glue->dev, "sdio PM caps = 0x%x\n", mmcflags);
if (mmcflags & MMC_PM_KEEP_POWER) if (mmcflags & MMC_PM_KEEP_POWER)
pdev_data->pdata->pwr_in_suspend = true; pdev_data.pdata->pwr_in_suspend = true;
sdio_set_drvdata(func, glue); sdio_set_drvdata(func, glue);
@ -289,7 +286,7 @@ static int wl1271_probe(struct sdio_func *func,
memset(res, 0x00, sizeof(res)); memset(res, 0x00, sizeof(res));
res[0].start = pdev_data->pdata->irq; res[0].start = pdev_data.pdata->irq;
res[0].flags = IORESOURCE_IRQ; res[0].flags = IORESOURCE_IRQ;
res[0].name = "irq"; res[0].name = "irq";
@ -299,8 +296,8 @@ static int wl1271_probe(struct sdio_func *func,
goto out_dev_put; goto out_dev_put;
} }
ret = platform_device_add_data(glue->core, pdev_data, ret = platform_device_add_data(glue->core, &pdev_data,
sizeof(*pdev_data)); sizeof(pdev_data));
if (ret) { if (ret) {
dev_err(glue->dev, "can't add platform data\n"); dev_err(glue->dev, "can't add platform data\n");
goto out_dev_put; goto out_dev_put;
@ -319,9 +316,6 @@ out_dev_put:
out_free_glue: out_free_glue:
kfree(glue); kfree(glue);
out_free_pdev_data:
kfree(pdev_data);
out: out:
return ret; return ret;
} }

23
drivers/net/wireless/ti/wlcore/spi.c
View File

@ -327,27 +327,25 @@ static struct wl1271_if_operations spi_ops = {
static int wl1271_probe(struct spi_device *spi) static int wl1271_probe(struct spi_device *spi)
{ {
struct wl12xx_spi_glue *glue; struct wl12xx_spi_glue *glue;
struct wlcore_platdev_data *pdev_data; struct wlcore_platdev_data pdev_data;
struct resource res[1]; struct resource res[1];
int ret = -ENOMEM; int ret = -ENOMEM;
pdev_data = kzalloc(sizeof(*pdev_data), GFP_KERNEL); memset(&pdev_data, 0x00, sizeof(pdev_data));
if (!pdev_data)
goto out;
pdev_data->pdata = dev_get_platdata(&spi->dev); pdev_data.pdata = dev_get_platdata(&spi->dev);
if (!pdev_data->pdata) { if (!pdev_data.pdata) {
dev_err(&spi->dev, "no platform data\n"); dev_err(&spi->dev, "no platform data\n");
ret = -ENODEV; ret = -ENODEV;
goto out_free_pdev_data; goto out;
} }
pdev_data->if_ops = &spi_ops; pdev_data.if_ops = &spi_ops;
glue = kzalloc(sizeof(*glue), GFP_KERNEL); glue = kzalloc(sizeof(*glue), GFP_KERNEL);
if (!glue) { if (!glue) {
dev_err(&spi->dev, "can't allocate glue\n"); dev_err(&spi->dev, "can't allocate glue\n");
goto out_free_pdev_data; goto out;
} }
glue->dev = &spi->dev; glue->dev = &spi->dev;
@ -385,8 +383,8 @@ static int wl1271_probe(struct spi_device *spi)
goto out_dev_put; goto out_dev_put;
} }
ret = platform_device_add_data(glue->core, pdev_data, ret = platform_device_add_data(glue->core, &pdev_data,
sizeof(*pdev_data)); sizeof(pdev_data));
if (ret) { if (ret) {
dev_err(glue->dev, "can't add platform data\n"); dev_err(glue->dev, "can't add platform data\n");
goto out_dev_put; goto out_dev_put;
@ -406,9 +404,6 @@ out_dev_put:
out_free_glue: out_free_glue:
kfree(glue); kfree(glue);
out_free_pdev_data:
kfree(pdev_data);
out: out:
return ret; return ret;
} }