diff options
author | Ben Hutchings <ben@decadent.org.uk> | 2012-05-14 20:36:00 -0400 |
---|---|---|
committer | Mauro Carvalho Chehab <mchehab@redhat.com> | 2012-05-20 10:43:05 -0400 |
commit | f27b853ea24a9b70585f9251384d97929e6551c3 (patch) | |
tree | 3ee3779961fb8356a54156fb472cb4a87ca9473f /drivers/media | |
parent | 81cda577422b85f98efc350e2520f2a2dc5f3ddb (diff) |
[media] rc: Fix invalid free_region and/or free_irq on probe failure
fintek-cir, ite-cir and nuvoton-cir may try to free an I/O region
and/or IRQ handler that was never allocated after a failure in their
respective probe functions. Add and use separate labels on the
failure path so they will do the right cleanup after each possible
point of failure.
Compile-tested only.
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Diffstat (limited to 'drivers/media')
-rw-r--r-- | drivers/media/rc/fintek-cir.c | 13 | ||||
-rw-r--r-- | drivers/media/rc/ite-cir.c | 14 | ||||
-rw-r--r-- | drivers/media/rc/nuvoton-cir.c | 26 |
3 files changed, 24 insertions, 29 deletions
diff --git a/drivers/media/rc/fintek-cir.c b/drivers/media/rc/fintek-cir.c index 4a3a238bcfb..6aabf7ae3a3 100644 --- a/drivers/media/rc/fintek-cir.c +++ b/drivers/media/rc/fintek-cir.c | |||
@@ -556,11 +556,11 @@ static int fintek_probe(struct pnp_dev *pdev, const struct pnp_device_id *dev_id | |||
556 | 556 | ||
557 | if (request_irq(fintek->cir_irq, fintek_cir_isr, IRQF_SHARED, | 557 | if (request_irq(fintek->cir_irq, fintek_cir_isr, IRQF_SHARED, |
558 | FINTEK_DRIVER_NAME, (void *)fintek)) | 558 | FINTEK_DRIVER_NAME, (void *)fintek)) |
559 | goto failure; | 559 | goto failure2; |
560 | 560 | ||
561 | ret = rc_register_device(rdev); | 561 | ret = rc_register_device(rdev); |
562 | if (ret) | 562 | if (ret) |
563 | goto failure; | 563 | goto failure3; |
564 | 564 | ||
565 | device_init_wakeup(&pdev->dev, true); | 565 | device_init_wakeup(&pdev->dev, true); |
566 | fintek->rdev = rdev; | 566 | fintek->rdev = rdev; |
@@ -570,12 +570,11 @@ static int fintek_probe(struct pnp_dev *pdev, const struct pnp_device_id *dev_id | |||
570 | 570 | ||
571 | return 0; | 571 | return 0; |
572 | 572 | ||
573 | failure3: | ||
574 | free_irq(fintek->cir_irq, fintek); | ||
575 | failure2: | ||
576 | release_region(fintek->cir_addr, fintek->cir_port_len); | ||
573 | failure: | 577 | failure: |
574 | if (fintek->cir_irq) | ||
575 | free_irq(fintek->cir_irq, fintek); | ||
576 | if (fintek->cir_addr) | ||
577 | release_region(fintek->cir_addr, fintek->cir_port_len); | ||
578 | |||
579 | rc_free_device(rdev); | 578 | rc_free_device(rdev); |
580 | kfree(fintek); | 579 | kfree(fintek); |
581 | 580 | ||
diff --git a/drivers/media/rc/ite-cir.c b/drivers/media/rc/ite-cir.c index 0e49c99abf6..36fe5a349b9 100644 --- a/drivers/media/rc/ite-cir.c +++ b/drivers/media/rc/ite-cir.c | |||
@@ -1598,24 +1598,22 @@ static int ite_probe(struct pnp_dev *pdev, const struct pnp_device_id | |||
1598 | 1598 | ||
1599 | if (request_irq(itdev->cir_irq, ite_cir_isr, IRQF_SHARED, | 1599 | if (request_irq(itdev->cir_irq, ite_cir_isr, IRQF_SHARED, |
1600 | ITE_DRIVER_NAME, (void *)itdev)) | 1600 | ITE_DRIVER_NAME, (void *)itdev)) |
1601 | goto failure; | 1601 | goto failure2; |
1602 | 1602 | ||
1603 | ret = rc_register_device(rdev); | 1603 | ret = rc_register_device(rdev); |
1604 | if (ret) | 1604 | if (ret) |
1605 | goto failure; | 1605 | goto failure3; |
1606 | 1606 | ||
1607 | itdev->rdev = rdev; | 1607 | itdev->rdev = rdev; |
1608 | ite_pr(KERN_NOTICE, "driver has been successfully loaded\n"); | 1608 | ite_pr(KERN_NOTICE, "driver has been successfully loaded\n"); |
1609 | 1609 | ||
1610 | return 0; | 1610 | return 0; |
1611 | 1611 | ||
1612 | failure3: | ||
1613 | free_irq(itdev->cir_irq, itdev); | ||
1614 | failure2: | ||
1615 | release_region(itdev->cir_addr, itdev->params.io_region_size); | ||
1612 | failure: | 1616 | failure: |
1613 | if (itdev->cir_irq) | ||
1614 | free_irq(itdev->cir_irq, itdev); | ||
1615 | |||
1616 | if (itdev->cir_addr) | ||
1617 | release_region(itdev->cir_addr, itdev->params.io_region_size); | ||
1618 | |||
1619 | rc_free_device(rdev); | 1617 | rc_free_device(rdev); |
1620 | kfree(itdev); | 1618 | kfree(itdev); |
1621 | 1619 | ||
diff --git a/drivers/media/rc/nuvoton-cir.c b/drivers/media/rc/nuvoton-cir.c index 8b2c071ac0a..dc8a7dddccd 100644 --- a/drivers/media/rc/nuvoton-cir.c +++ b/drivers/media/rc/nuvoton-cir.c | |||
@@ -1075,19 +1075,19 @@ static int nvt_probe(struct pnp_dev *pdev, const struct pnp_device_id *dev_id) | |||
1075 | 1075 | ||
1076 | if (request_irq(nvt->cir_irq, nvt_cir_isr, IRQF_SHARED, | 1076 | if (request_irq(nvt->cir_irq, nvt_cir_isr, IRQF_SHARED, |
1077 | NVT_DRIVER_NAME, (void *)nvt)) | 1077 | NVT_DRIVER_NAME, (void *)nvt)) |
1078 | goto failure; | 1078 | goto failure2; |
1079 | 1079 | ||
1080 | if (!request_region(nvt->cir_wake_addr, | 1080 | if (!request_region(nvt->cir_wake_addr, |
1081 | CIR_IOREG_LENGTH, NVT_DRIVER_NAME)) | 1081 | CIR_IOREG_LENGTH, NVT_DRIVER_NAME)) |
1082 | goto failure; | 1082 | goto failure3; |
1083 | 1083 | ||
1084 | if (request_irq(nvt->cir_wake_irq, nvt_cir_wake_isr, IRQF_SHARED, | 1084 | if (request_irq(nvt->cir_wake_irq, nvt_cir_wake_isr, IRQF_SHARED, |
1085 | NVT_DRIVER_NAME, (void *)nvt)) | 1085 | NVT_DRIVER_NAME, (void *)nvt)) |
1086 | goto failure; | 1086 | goto failure4; |
1087 | 1087 | ||
1088 | ret = rc_register_device(rdev); | 1088 | ret = rc_register_device(rdev); |
1089 | if (ret) | 1089 | if (ret) |
1090 | goto failure; | 1090 | goto failure5; |
1091 | 1091 | ||
1092 | device_init_wakeup(&pdev->dev, true); | 1092 | device_init_wakeup(&pdev->dev, true); |
1093 | nvt->rdev = rdev; | 1093 | nvt->rdev = rdev; |
@@ -1099,17 +1099,15 @@ static int nvt_probe(struct pnp_dev *pdev, const struct pnp_device_id *dev_id) | |||
1099 | 1099 | ||
1100 | return 0; | 1100 | return 0; |
1101 | 1101 | ||
1102 | failure5: | ||
1103 | free_irq(nvt->cir_wake_irq, nvt); | ||
1104 | failure4: | ||
1105 | release_region(nvt->cir_wake_addr, CIR_IOREG_LENGTH); | ||
1106 | failure3: | ||
1107 | free_irq(nvt->cir_irq, nvt); | ||
1108 | failure2: | ||
1109 | release_region(nvt->cir_addr, CIR_IOREG_LENGTH); | ||
1102 | failure: | 1110 | failure: |
1103 | if (nvt->cir_irq) | ||
1104 | free_irq(nvt->cir_irq, nvt); | ||
1105 | if (nvt->cir_addr) | ||
1106 | release_region(nvt->cir_addr, CIR_IOREG_LENGTH); | ||
1107 | |||
1108 | if (nvt->cir_wake_irq) | ||
1109 | free_irq(nvt->cir_wake_irq, nvt); | ||
1110 | if (nvt->cir_wake_addr) | ||
1111 | release_region(nvt->cir_wake_addr, CIR_IOREG_LENGTH); | ||
1112 | |||
1113 | rc_free_device(rdev); | 1111 | rc_free_device(rdev); |
1114 | kfree(nvt); | 1112 | kfree(nvt); |
1115 | 1113 | ||