From cabea695875e3a07313c205a9753c7416126dfa2 Mon Sep 17 00:00:00 2001 From: Sudip Mukherjee Date: Mon, 15 Jun 2015 20:05:49 +0530 Subject: parport: fix error handling After registering the device if exclusive access fails for any reason then we need to unregister the device to remove all references. Signed-off-by: Sudip Mukherjee Signed-off-by: Greg Kroah-Hartman --- drivers/parport/share.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'drivers/parport/share.c') diff --git a/drivers/parport/share.c b/drivers/parport/share.c index 8067f54ce050..d8079e37a606 100644 --- a/drivers/parport/share.c +++ b/drivers/parport/share.c @@ -907,7 +907,8 @@ parport_register_dev_model(struct parport *port, const char *name, spin_unlock(&port->physport->pardevice_lock); pr_debug("%s: cannot grant exclusive access for device %s\n", port->name, name); - goto err_put_dev; + device_unregister(&par_dev->dev); + goto err_put_port; } port->flags |= PARPORT_FLAG_EXCL; } -- cgit v1.2.3 From 23c405912b881e3ca516554efde852c2ad550b31 Mon Sep 17 00:00:00 2001 From: Sudip Mukherjee Date: Mon, 15 Jun 2015 20:05:50 +0530 Subject: parport: fix memory leak After the reference count becomes 0 when put_device() is called, it will execute the release callback where we are freeing all the allocated memory associated with the device. We missed freeing par_dev->state. Signed-off-by: Sudip Mukherjee Signed-off-by: Greg Kroah-Hartman --- drivers/parport/share.c | 1 + 1 file changed, 1 insertion(+) (limited to 'drivers/parport/share.c') diff --git a/drivers/parport/share.c b/drivers/parport/share.c index d8079e37a606..1efec44e03aa 100644 --- a/drivers/parport/share.c +++ b/drivers/parport/share.c @@ -816,6 +816,7 @@ static void free_pardevice(struct device *dev) struct pardevice *par_dev = to_pardevice(dev); kfree(par_dev->name); + kfree(par_dev->state); kfree(par_dev); } -- cgit v1.2.3 From 68d35c7b3b1aa686e3039eb2626bf5e3ea8dbe81 Mon Sep 17 00:00:00 2001 From: Sudip Mukherjee Date: Mon, 15 Jun 2015 20:05:51 +0530 Subject: parport: fix freeing freed memory After the reference count becomes 0 when put_device() is called, it will execute the release callback where we are freeing all the allocated memory associated with the device. So if we just continue on the error path then we are again freeing devname and trying to dereference par_dev which has already been free-ed in the release callback. Signed-off-by: Sudip Mukherjee Signed-off-by: Greg Kroah-Hartman --- drivers/parport/share.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) (limited to 'drivers/parport/share.c') diff --git a/drivers/parport/share.c b/drivers/parport/share.c index 1efec44e03aa..c02b5f27798b 100644 --- a/drivers/parport/share.c +++ b/drivers/parport/share.c @@ -892,8 +892,10 @@ parport_register_dev_model(struct parport *port, const char *name, par_dev->dev.release = free_pardevice; par_dev->devmodel = true; ret = device_register(&par_dev->dev); - if (ret) - goto err_put_dev; + if (ret) { + put_device(&par_dev->dev); + goto err_put_port; + } /* Chain this onto the list */ par_dev->prev = NULL; @@ -940,8 +942,6 @@ parport_register_dev_model(struct parport *port, const char *name, return par_dev; -err_put_dev: - put_device(&par_dev->dev); err_free_devname: kfree(devname); err_free_par_dev: -- cgit v1.2.3 From 4e5a74f1db8d6bea48306126fd445e2720f07a95 Mon Sep 17 00:00:00 2001 From: Sudip Mukherjee Date: Sat, 25 Jul 2015 13:19:40 +0530 Subject: parport: Revert "parport: fix memory leak" This reverts commit 23c405912b88 ("parport: fix memory leak") par_dev->state was already being removed in parport_unregister_device(). Reported-by: Ying Huang Signed-off-by: Sudip Mukherjee Signed-off-by: Greg Kroah-Hartman --- drivers/parport/share.c | 1 - 1 file changed, 1 deletion(-) (limited to 'drivers/parport/share.c') diff --git a/drivers/parport/share.c b/drivers/parport/share.c index c02b5f27798b..5ce5ef211bdb 100644 --- a/drivers/parport/share.c +++ b/drivers/parport/share.c @@ -816,7 +816,6 @@ static void free_pardevice(struct device *dev) struct pardevice *par_dev = to_pardevice(dev); kfree(par_dev->name); - kfree(par_dev->state); kfree(par_dev); } -- cgit v1.2.3