iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[media] staging/lirc: fix mem leaks and ptr err usage

Browse Source 
When the lirc drivers were converted over to using memdup_user, I
mistakenly also removed corresponding calls to kfree. Add those back. I
also screwed up on the allocation error check in lirc_serial, using if
(PTR_ERR()) instead of if (IS_ERR()), which broke transmit.

Reported-by: Jiri Fojtasek <jiri.fojtasek@hlohovec.net>
Signed-off-by: Jarod Wilson <jarod@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
This commit is contained in:
Jarod Wilson 2011-01-17 16:02:00 -03:00 committed by Mauro Carvalho Chehab
parent 559d162e1e
commit 88914bdf8c
6 changed files with 20 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
drivers/staging/lirc/lirc_imon.c
View File

@ -447,6 +447,7 @@ static ssize_t vfd_write(struct file *file, const char *buf,
exit: exit:
mutex_unlock(&context->ctx_lock); mutex_unlock(&context->ctx_lock);
kfree(data_buf);
return (!retval) ? n_bytes : retval; return (!retval) ? n_bytes : retval;
} }

1
drivers/staging/lirc/lirc_it87.c
View File

@ -232,6 +232,7 @@ static ssize_t lirc_write(struct file *file, const char *buf,
i++; i++;
} }
terminate_send(tx_buf[i - 1]); terminate_send(tx_buf[i - 1]);
kfree(tx_buf);
return n; return n;
} }

19
drivers/staging/lirc/lirc_parallel.c
View File

@ -376,6 +376,7 @@ static ssize_t lirc_write(struct file *filep, const char *buf, size_t n,
unsigned long flags; unsigned long flags;
int counttimer; int counttimer;
int *wbuf; int *wbuf;
ssize_t ret;
if (!is_claimed) if (!is_claimed)
return -EBUSY; return -EBUSY;
@ -393,8 +394,10 @@ static ssize_t lirc_write(struct file *filep, const char *buf, size_t n,
if (timer == 0) { if (timer == 0) {
/* try again if device is ready */ /* try again if device is ready */
timer = init_lirc_timer(); timer = init_lirc_timer();
if (timer == 0) if (timer == 0) {
return -EIO; ret = -EIO;
goto out;
}
} }
/* adjust values from usecs */ /* adjust values from usecs */
@ -420,7 +423,8 @@ static ssize_t lirc_write(struct file *filep, const char *buf, size_t n,
if (check_pselecd && (in(1) & LP_PSELECD)) { if (check_pselecd && (in(1) & LP_PSELECD)) {
lirc_off(); lirc_off();
local_irq_restore(flags); local_irq_restore(flags);
return -EIO; ret = -EIO;
goto out;
} }
} while (counttimer < wbuf[i]); } while (counttimer < wbuf[i]);
i++; i++;
@ -436,7 +440,8 @@ static ssize_t lirc_write(struct file *filep, const char *buf, size_t n,
level = newlevel; level = newlevel;
if (check_pselecd && (in(1) & LP_PSELECD)) { if (check_pselecd && (in(1) & LP_PSELECD)) {
local_irq_restore(flags); local_irq_restore(flags);
return -EIO; ret = -EIO;
goto out;
} }
} while (counttimer < wbuf[i]); } while (counttimer < wbuf[i]);
i++; i++;
@ -445,7 +450,11 @@ static ssize_t lirc_write(struct file *filep, const char *buf, size_t n,
#else #else
/* place code that handles write without external timer here */ /* place code that handles write without external timer here */
#endif #endif
return n; ret = n;
out:
kfree(wbuf);
return ret;
} }
static unsigned int lirc_poll(struct file *file, poll_table *wait) static unsigned int lirc_poll(struct file *file, poll_table *wait)

1
drivers/staging/lirc/lirc_sasem.c
View File

@ -448,6 +448,7 @@ static ssize_t vfd_write(struct file *file, const char *buf,
exit: exit:
mutex_unlock(&context->ctx_lock); mutex_unlock(&context->ctx_lock);
kfree(data_buf);
return (!retval) ? n_bytes : retval; return (!retval) ? n_bytes : retval;
} }

3
drivers/staging/lirc/lirc_serial.c
View File

@ -966,7 +966,7 @@ static ssize_t lirc_write(struct file *file, const char *buf,
if (n % sizeof(int) || count % 2 == 0) if (n % sizeof(int) || count % 2 == 0)
return -EINVAL; return -EINVAL;
wbuf = memdup_user(buf, n); wbuf = memdup_user(buf, n);
if (PTR_ERR(wbuf)) if (IS_ERR(wbuf))
return PTR_ERR(wbuf); return PTR_ERR(wbuf);
spin_lock_irqsave(&hardware[type].lock, flags); spin_lock_irqsave(&hardware[type].lock, flags);
if (type == LIRC_IRDEO) { if (type == LIRC_IRDEO) {
@ -981,6 +981,7 @@ static ssize_t lirc_write(struct file *file, const char *buf,
} }
off(); off();
spin_unlock_irqrestore(&hardware[type].lock, flags); spin_unlock_irqrestore(&hardware[type].lock, flags);
kfree(wbuf);
return n; return n;
} }

1
drivers/staging/lirc/lirc_sir.c
View File

@ -330,6 +330,7 @@ static ssize_t lirc_write(struct file *file, const char *buf, size_t n,
/* enable receiver */ /* enable receiver */
Ser2UTCR3 = UTCR3_RXE|UTCR3_RIE; Ser2UTCR3 = UTCR3_RXE|UTCR3_RIE;
#endif #endif
kfree(tx_buf);
return count; return count;
} }