summaryrefslogtreecommitdiff
path: root/drivers/media
diff options
context:
space:
mode:
authorSean Young <sean@mess.org>2016-02-19 17:33:53 +0300
committerMauro Carvalho Chehab <mchehab@osg.samsung.com>2016-03-03 17:44:29 +0300
commita40973ff101ff8d3a42a8222e3119292f4191b07 (patch)
tree3d62ade9a625a58fac5ddbd4fd4782e99a8c7840 /drivers/media
parent050b6c98b42ff77894da2aad34fcf0d4e1fed8e7 (diff)
downloadlinux-a40973ff101ff8d3a42a8222e3119292f4191b07.tar.xz
[media] igorplugusb: fix leaks in error path
Since rc_allocate_device() uses kmalloc, it can returns NULL, so need to check, otherwise, NULL derefenrece can happen. Reported-by: Insu Yun <wuninsu@gmail.com> Signed-off-by: Sean Young <sean@mess.org> Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Diffstat (limited to 'drivers/media')
-rw-r--r--drivers/media/rc/igorplugusb.c17
1 files changed, 12 insertions, 5 deletions
diff --git a/drivers/media/rc/igorplugusb.c b/drivers/media/rc/igorplugusb.c
index b36e51576f8e..e0c531fa01da 100644
--- a/drivers/media/rc/igorplugusb.c
+++ b/drivers/media/rc/igorplugusb.c
@@ -152,7 +152,7 @@ static int igorplugusb_probe(struct usb_interface *intf,
struct usb_endpoint_descriptor *ep;
struct igorplugusb *ir;
struct rc_dev *rc;
- int ret;
+ int ret = -ENOMEM;
udev = interface_to_usbdev(intf);
idesc = intf->cur_altsetting;
@@ -182,7 +182,7 @@ static int igorplugusb_probe(struct usb_interface *intf,
ir->urb = usb_alloc_urb(0, GFP_KERNEL);
if (!ir->urb)
- return -ENOMEM;
+ goto fail;
usb_fill_control_urb(ir->urb, udev,
usb_rcvctrlpipe(udev, 0), (uint8_t *)&ir->request,
@@ -191,6 +191,9 @@ static int igorplugusb_probe(struct usb_interface *intf,
usb_make_path(udev, ir->phys, sizeof(ir->phys));
rc = rc_allocate_device();
+ if (!rc)
+ goto fail;
+
rc->input_name = DRIVER_DESC;
rc->input_phys = ir->phys;
usb_to_input_id(udev, &rc->input_id);
@@ -214,9 +217,7 @@ static int igorplugusb_probe(struct usb_interface *intf,
ret = rc_register_device(rc);
if (ret) {
dev_err(&intf->dev, "failed to register rc device: %d", ret);
- rc_free_device(rc);
- usb_free_urb(ir->urb);
- return ret;
+ goto fail;
}
usb_set_intfdata(intf, ir);
@@ -224,6 +225,12 @@ static int igorplugusb_probe(struct usb_interface *intf,
igorplugusb_cmd(ir, SET_INFRABUFFER_EMPTY);
return 0;
+fail:
+ rc_free_device(ir->rc);
+ usb_free_urb(ir->urb);
+ del_timer(&ir->timer);
+
+ return ret;
}
static void igorplugusb_disconnect(struct usb_interface *intf)