aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--drivers/char/sonypi.c24
-rw-r--r--drivers/input/misc/uinput.c23
-rw-r--r--include/linux/input.h6
3 files changed, 17 insertions, 36 deletions
diff --git a/drivers/char/sonypi.c b/drivers/char/sonypi.c
index 983915bf87f1..cefbe985e55c 100644
--- a/drivers/char/sonypi.c
+++ b/drivers/char/sonypi.c
@@ -1228,14 +1228,7 @@ static int __devinit sonypi_probe(void)
1228 sonypi_device.input_jog_dev.keybit[LONG(BTN_MOUSE)] = 1228 sonypi_device.input_jog_dev.keybit[LONG(BTN_MOUSE)] =
1229 BIT(BTN_MIDDLE); 1229 BIT(BTN_MIDDLE);
1230 sonypi_device.input_jog_dev.relbit[0] = BIT(REL_WHEEL); 1230 sonypi_device.input_jog_dev.relbit[0] = BIT(REL_WHEEL);
1231 sonypi_device.input_jog_dev.name = 1231 sonypi_device.input_jog_dev.name = SONYPI_JOG_INPUTNAME;
1232 kmalloc(sizeof(SONYPI_JOG_INPUTNAME), GFP_KERNEL);
1233 if (!sonypi_device.input_jog_dev.name) {
1234 printk(KERN_ERR "sonypi: kmalloc failed\n");
1235 ret = -ENOMEM;
1236 goto out_inkmallocinput1;
1237 }
1238 sprintf(sonypi_device.input_jog_dev.name, SONYPI_JOG_INPUTNAME);
1239 sonypi_device.input_jog_dev.id.bustype = BUS_ISA; 1232 sonypi_device.input_jog_dev.id.bustype = BUS_ISA;
1240 sonypi_device.input_jog_dev.id.vendor = PCI_VENDOR_ID_SONY; 1233 sonypi_device.input_jog_dev.id.vendor = PCI_VENDOR_ID_SONY;
1241 1234
@@ -1249,14 +1242,7 @@ static int __devinit sonypi_probe(void)
1249 if (sonypi_inputkeys[i].inputev) 1242 if (sonypi_inputkeys[i].inputev)
1250 set_bit(sonypi_inputkeys[i].inputev, 1243 set_bit(sonypi_inputkeys[i].inputev,
1251 sonypi_device.input_key_dev.keybit); 1244 sonypi_device.input_key_dev.keybit);
1252 sonypi_device.input_key_dev.name = 1245 sonypi_device.input_key_dev.name = SONYPI_KEY_INPUTNAME;
1253 kmalloc(sizeof(SONYPI_KEY_INPUTNAME), GFP_KERNEL);
1254 if (!sonypi_device.input_key_dev.name) {
1255 printk(KERN_ERR "sonypi: kmalloc failed\n");
1256 ret = -ENOMEM;
1257 goto out_inkmallocinput2;
1258 }
1259 sprintf(sonypi_device.input_key_dev.name, SONYPI_KEY_INPUTNAME);
1260 sonypi_device.input_key_dev.id.bustype = BUS_ISA; 1246 sonypi_device.input_key_dev.id.bustype = BUS_ISA;
1261 sonypi_device.input_key_dev.id.vendor = PCI_VENDOR_ID_SONY; 1247 sonypi_device.input_key_dev.id.vendor = PCI_VENDOR_ID_SONY;
1262 1248
@@ -1314,11 +1300,7 @@ out_platformdev:
1314 kfifo_free(sonypi_device.input_fifo); 1300 kfifo_free(sonypi_device.input_fifo);
1315out_infifo: 1301out_infifo:
1316 input_unregister_device(&sonypi_device.input_key_dev); 1302 input_unregister_device(&sonypi_device.input_key_dev);
1317 kfree(sonypi_device.input_key_dev.name);
1318out_inkmallocinput2:
1319 input_unregister_device(&sonypi_device.input_jog_dev); 1303 input_unregister_device(&sonypi_device.input_jog_dev);
1320 kfree(sonypi_device.input_jog_dev.name);
1321out_inkmallocinput1:
1322 free_irq(sonypi_device.irq, sonypi_irq); 1304 free_irq(sonypi_device.irq, sonypi_irq);
1323out_reqirq: 1305out_reqirq:
1324 release_region(sonypi_device.ioport1, sonypi_device.region_size); 1306 release_region(sonypi_device.ioport1, sonypi_device.region_size);
@@ -1345,9 +1327,7 @@ static void __devexit sonypi_remove(void)
1345 1327
1346 if (useinput) { 1328 if (useinput) {
1347 input_unregister_device(&sonypi_device.input_key_dev); 1329 input_unregister_device(&sonypi_device.input_key_dev);
1348 kfree(sonypi_device.input_key_dev.name);
1349 input_unregister_device(&sonypi_device.input_jog_dev); 1330 input_unregister_device(&sonypi_device.input_jog_dev);
1350 kfree(sonypi_device.input_jog_dev.name);
1351 kfifo_free(sonypi_device.input_fifo); 1331 kfifo_free(sonypi_device.input_fifo);
1352 } 1332 }
1353 1333
diff --git a/drivers/input/misc/uinput.c b/drivers/input/misc/uinput.c
index c3eebf593ab6..d5c5b32045af 100644
--- a/drivers/input/misc/uinput.c
+++ b/drivers/input/misc/uinput.c
@@ -251,6 +251,7 @@ static int uinput_alloc_device(struct file *file, const char __user *buffer, siz
251 struct uinput_user_dev *user_dev; 251 struct uinput_user_dev *user_dev;
252 struct input_dev *dev; 252 struct input_dev *dev;
253 struct uinput_device *udev; 253 struct uinput_device *udev;
254 char *name;
254 int size; 255 int size;
255 int retval; 256 int retval;
256 257
@@ -274,13 +275,13 @@ static int uinput_alloc_device(struct file *file, const char __user *buffer, siz
274 kfree(dev->name); 275 kfree(dev->name);
275 276
276 size = strnlen(user_dev->name, UINPUT_MAX_NAME_SIZE) + 1; 277 size = strnlen(user_dev->name, UINPUT_MAX_NAME_SIZE) + 1;
277 dev->name = kmalloc(size, GFP_KERNEL); 278 dev->name = name = kmalloc(size, GFP_KERNEL);
278 if (!dev->name) { 279 if (!name) {
279 retval = -ENOMEM; 280 retval = -ENOMEM;
280 goto exit; 281 goto exit;
281 } 282 }
283 strlcpy(name, user_dev->name, size);
282 284
283 strlcpy(dev->name, user_dev->name, size);
284 dev->id.bustype = user_dev->id.bustype; 285 dev->id.bustype = user_dev->id.bustype;
285 dev->id.vendor = user_dev->id.vendor; 286 dev->id.vendor = user_dev->id.vendor;
286 dev->id.product = user_dev->id.product; 287 dev->id.product = user_dev->id.product;
@@ -397,6 +398,7 @@ static int uinput_ioctl(struct inode *inode, struct file *file, unsigned int cmd
397 struct uinput_ff_erase ff_erase; 398 struct uinput_ff_erase ff_erase;
398 struct uinput_request *req; 399 struct uinput_request *req;
399 int length; 400 int length;
401 char *phys;
400 402
401 udev = file->private_data; 403 udev = file->private_data;
402 404
@@ -494,20 +496,19 @@ static int uinput_ioctl(struct inode *inode, struct file *file, unsigned int cmd
494 retval = -EFAULT; 496 retval = -EFAULT;
495 break; 497 break;
496 } 498 }
497 if (NULL != udev->dev->phys) 499 kfree(udev->dev->phys);
498 kfree(udev->dev->phys); 500 udev->dev->phys = phys = kmalloc(length, GFP_KERNEL);
499 udev->dev->phys = kmalloc(length, GFP_KERNEL); 501 if (!phys) {
500 if (!udev->dev->phys) {
501 retval = -ENOMEM; 502 retval = -ENOMEM;
502 break; 503 break;
503 } 504 }
504 if (copy_from_user(udev->dev->phys, p, length)) { 505 if (copy_from_user(phys, p, length)) {
505 retval = -EFAULT;
506 kfree(udev->dev->phys);
507 udev->dev->phys = NULL; 506 udev->dev->phys = NULL;
507 kfree(phys);
508 retval = -EFAULT;
508 break; 509 break;
509 } 510 }
510 udev->dev->phys[length - 1] = '\0'; 511 phys[length - 1] = '\0';
511 break; 512 break;
512 513
513 case UI_BEGIN_FF_UPLOAD: 514 case UI_BEGIN_FF_UPLOAD:
diff --git a/include/linux/input.h b/include/linux/input.h
index b9cc0ac71f44..bdc53c6cc962 100644
--- a/include/linux/input.h
+++ b/include/linux/input.h
@@ -811,9 +811,9 @@ struct input_dev {
811 811
812 void *private; 812 void *private;
813 813
814 char *name; 814 const char *name;
815 char *phys; 815 const char *phys;
816 char *uniq; 816 const char *uniq;
817 struct input_id id; 817 struct input_id id;
818 818
819 unsigned long evbit[NBITS(EV_MAX)]; 819 unsigned long evbit[NBITS(EV_MAX)];