ret might be uninitialized and is returned that way when kstrdup of
rbd_dev->spec->snap_name fails. Fix it by returning ENOMEM from that
place.
Signed-off-by: Jiri Slaby <[email protected]>
---
drivers/block/rbd.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
index 6b2b039..3417f34 100644
--- a/drivers/block/rbd.c
+++ b/drivers/block/rbd.c
@@ -3113,8 +3113,10 @@ static int rbd_dev_probe_update_spec(struct rbd_device *rbd_dev)
goto out_err;
}
rbd_dev->spec->snap_name = kstrdup(name, GFP_KERNEL);
- if(!rbd_dev->spec->snap_name)
+ if(!rbd_dev->spec->snap_name) {
+ ret = -ENOMEM;
goto out_err;
+ }
return 0;
out_err:
--
1.8.2
In build, we open a file, read that but do not close it. Fix that by
sticking fclose at the right place.
Signed-off-by: Jiri Slaby <[email protected]>
Cc: "H. Peter Anvin" <[email protected]>
Cc: Thomas Gleixner <[email protected]>
Cc: Ingo Molnar <[email protected]>
Cc: [email protected]
---
arch/x86/boot/tools/build.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/x86/boot/tools/build.c b/arch/x86/boot/tools/build.c
index 94c5446..c941d6a 100644
--- a/arch/x86/boot/tools/build.c
+++ b/arch/x86/boot/tools/build.c
@@ -243,6 +243,7 @@ static void parse_zoffset(char *fname)
c = fread(buf, 1, sizeof(buf) - 1, file);
if (ferror(file))
die("read-error on `zoffset.h'");
+ fclose(file);
buf[c] = 0;
p = (char *)buf;
--
1.8.2
changed is not initialized in path_power_down_sync, but it is expected
to be false in case no change happened in the loop. So set it to
false.
Signed-off-by: Jiri Slaby <[email protected]>
Cc: Jaroslav Kysela <[email protected]>
Cc: Takashi Iwai <[email protected]>
---
sound/pci/hda/hda_generic.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c
index f0a422f..8299e40 100644
--- a/sound/pci/hda/hda_generic.c
+++ b/sound/pci/hda/hda_generic.c
@@ -751,7 +751,7 @@ EXPORT_SYMBOL_HDA(snd_hda_activate_path);
static void path_power_down_sync(struct hda_codec *codec, struct nid_path *path)
{
struct hda_gen_spec *spec = codec->spec;
- bool changed;
+ bool changed = false;
int i;
if (!spec->power_down_unused || path->active)
--
1.8.2
rc_unregister_device already calls rc_free_device to free the passed
device. But in one of ttusbir's probe fail paths, we call
rc_unregister_device _and_ rc_free_device. This is wrong and results
in a double free.
Instead, set rc to NULL resulting in rc_free_device being a noop.
Signed-off-by: Jiri Slaby <[email protected]>
Cc: Sean Young <[email protected]>
Cc: Mauro Carvalho Chehab <[email protected]>
Cc: [email protected]
---
drivers/media/rc/ttusbir.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/media/rc/ttusbir.c b/drivers/media/rc/ttusbir.c
index cf0d47f..891762d 100644
--- a/drivers/media/rc/ttusbir.c
+++ b/drivers/media/rc/ttusbir.c
@@ -347,6 +347,7 @@ static int ttusbir_probe(struct usb_interface *intf,
return 0;
out3:
rc_unregister_device(rc);
+ rc = NULL;
out2:
led_classdev_unregister(&tt->led);
out:
--
1.8.2
In pointer_press_speed_show, we do
data_pointer = hid_get_drvdata(hdev);
twice in a row. Remove one of those.
Signed-off-by: Jiri Slaby <[email protected]>
Cc: Jiri Kosina <[email protected]>
Cc: [email protected]
---
drivers/hid/hid-lenovo-tpkbd.c | 2 --
1 file changed, 2 deletions(-)
diff --git a/drivers/hid/hid-lenovo-tpkbd.c b/drivers/hid/hid-lenovo-tpkbd.c
index a0535fd..07837f5 100644
--- a/drivers/hid/hid-lenovo-tpkbd.c
+++ b/drivers/hid/hid-lenovo-tpkbd.c
@@ -228,8 +228,6 @@ static ssize_t pointer_press_speed_show(struct device *dev,
struct hid_device *hdev = container_of(dev, struct hid_device, dev);
struct tpkbd_data_pointer *data_pointer = hid_get_drvdata(hdev);
- data_pointer = hid_get_drvdata(hdev);
-
return snprintf(buf, PAGE_SIZE, "%u\n",
data_pointer->press_speed);
}
--
1.8.2
On Thu, 4 Apr 2013, Jiri Slaby wrote:
> In pointer_press_speed_show, we do
> data_pointer = hid_get_drvdata(hdev);
> twice in a row. Remove one of those.
>
> Signed-off-by: Jiri Slaby <[email protected]>
> Cc: Jiri Kosina <[email protected]>
> Cc: [email protected]
> ---
> drivers/hid/hid-lenovo-tpkbd.c | 2 --
> 1 file changed, 2 deletions(-)
>
> diff --git a/drivers/hid/hid-lenovo-tpkbd.c b/drivers/hid/hid-lenovo-tpkbd.c
> index a0535fd..07837f5 100644
> --- a/drivers/hid/hid-lenovo-tpkbd.c
> +++ b/drivers/hid/hid-lenovo-tpkbd.c
> @@ -228,8 +228,6 @@ static ssize_t pointer_press_speed_show(struct device *dev,
> struct hid_device *hdev = container_of(dev, struct hid_device, dev);
> struct tpkbd_data_pointer *data_pointer = hid_get_drvdata(hdev);
>
> - data_pointer = hid_get_drvdata(hdev);
> -
Applied, thanks.
--
Jiri Kosina
SUSE Labs
Jiri Slaby <[email protected]> writes:
> ret might be uninitialized and is returned that way when kstrdup of
> rbd_dev->spec->snap_name fails. Fix it by returning ENOMEM from that
> place.
>
> Signed-off-by: Jiri Slaby <[email protected]>
> ---
> drivers/block/rbd.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
Acked-by: Nikola Pajkovsky <[email protected]>
--
Nikola
Jiri Slaby <[email protected]> writes:
> In pointer_press_speed_show, we do
> data_pointer = hid_get_drvdata(hdev);
> twice in a row. Remove one of those.
>
> Signed-off-by: Jiri Slaby <[email protected]>
> Cc: Jiri Kosina <[email protected]>
> Cc: [email protected]
> ---
> drivers/hid/hid-lenovo-tpkbd.c | 2 --
> 1 file changed, 2 deletions(-)
Acked-by: Nikola Pajkovsky <[email protected]>
--
Nikola
At Thu, 4 Apr 2013 22:32:10 +0200,
Jiri Slaby wrote:
>
> changed is not initialized in path_power_down_sync, but it is expected
> to be false in case no change happened in the loop. So set it to
> false.
>
> Signed-off-by: Jiri Slaby <[email protected]>
> Cc: Jaroslav Kysela <[email protected]>
> Cc: Takashi Iwai <[email protected]>
Thanks, applied.
Takashi
> ---
> sound/pci/hda/hda_generic.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c
> index f0a422f..8299e40 100644
> --- a/sound/pci/hda/hda_generic.c
> +++ b/sound/pci/hda/hda_generic.c
> @@ -751,7 +751,7 @@ EXPORT_SYMBOL_HDA(snd_hda_activate_path);
> static void path_power_down_sync(struct hda_codec *codec, struct nid_path *path)
> {
> struct hda_gen_spec *spec = codec->spec;
> - bool changed;
> + bool changed = false;
> int i;
>
> if (!spec->power_down_unused || path->active)
> --
> 1.8.2
>
>
On Thu, Apr 04, 2013 at 10:32:09PM +0200, Jiri Slaby wrote:
> rc_unregister_device already calls rc_free_device to free the passed
> device. But in one of ttusbir's probe fail paths, we call
> rc_unregister_device _and_ rc_free_device. This is wrong and results
> in a double free.
>
> Instead, set rc to NULL resulting in rc_free_device being a noop.
>
> Signed-off-by: Jiri Slaby <[email protected]>
> Cc: Sean Young <[email protected]>
> Cc: Mauro Carvalho Chehab <[email protected]>
> Cc: [email protected]
> ---
> drivers/media/rc/ttusbir.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/drivers/media/rc/ttusbir.c b/drivers/media/rc/ttusbir.c
> index cf0d47f..891762d 100644
> --- a/drivers/media/rc/ttusbir.c
> +++ b/drivers/media/rc/ttusbir.c
> @@ -347,6 +347,7 @@ static int ttusbir_probe(struct usb_interface *intf,
> return 0;
> out3:
> rc_unregister_device(rc);
> + rc = NULL;
> out2:
> led_classdev_unregister(&tt->led);
> out:
> --
Acked-by: Sean Young <[email protected]>
Sean