2015-04-04 00:16:23

by Alexey Khoroshilov

Subject: [PATCH] [media] marvell-ccic: fix memory leak on failure path in cafe_smbus_setup()

If i2c_add_adapter() fails, adap is not deallocated.

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Alexey Khoroshilov <[email protected]>
---
drivers/media/platform/marvell-ccic/cafe-driver.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/drivers/media/platform/marvell-ccic/cafe-driver.c b/drivers/media/platform/marvell-ccic/cafe-driver.c
index 562845361246..9d45505370cd 100644
--- a/drivers/media/platform/marvell-ccic/cafe-driver.c
+++ b/drivers/media/platform/marvell-ccic/cafe-driver.c
@@ -339,17 +339,21 @@ static int cafe_smbus_setup(struct cafe_camera *cam)
adap = kzalloc(sizeof(*adap), GFP_KERNEL);
if (adap == NULL)
return -ENOMEM;
- cam->mcam.i2c_adapter = adap;
- cafe_smbus_enable_irq(cam);
adap->owner = THIS_MODULE;
adap->algo = &cafe_smbus_algo;
strcpy(adap->name, "cafe_ccic");
adap->dev.parent = &cam->pdev->dev;
i2c_set_adapdata(adap, cam);
ret = i2c_add_adapter(adap);
- if (ret)
+ if (ret) {
printk(KERN_ERR "Unable to register cafe i2c adapter\n");
- return ret;
+ kfree(adap);
+ return ret;
+ }
+
+ cam->mcam.i2c_adapter = adap;
+ cafe_smbus_enable_irq(cam);
+ return 0;
}

static void cafe_smbus_shutdown(struct cafe_camera *cam)
--
1.9.1

2015-04-04 13:36:59

by Jonathan Corbet

Subject: Re: [PATCH] [media] marvell-ccic: fix memory leak on failure path in cafe_smbus_setup()

On Sat, 4 Apr 2015 03:16:01 +0300
Alexey Khoroshilov <[email protected]> wrote:

> If i2c_add_adapter() fails, adap is not deallocated.
>
> Found by Linux Driver Verification project (linuxtesting.org).
>
> Signed-off-by: Alexey Khoroshilov <[email protected]>

Actually, the worse thing is that it leaves the IRQ enabled...it's good
you moved that lines down. Even better, of course, that the failure path
has probably never been run during the life of this driver...:)

Should there be some sort of proper reported-by line for the driver
verification project?

Acked-by: Jonathan Corbet <[email protected]>

jon

2015-04-04 16:59:25

by Alexey Khoroshilov

Subject: Re: [PATCH] [media] marvell-ccic: fix memory leak on failure path in cafe_smbus_setup()

On 04.04.2015 16:36, Jonathan Corbet wrote:
> On Sat, 4 Apr 2015 03:16:01 +0300
> Alexey Khoroshilov <[email protected]> wrote:
>
>> If i2c_add_adapter() fails, adap is not deallocated.
>>
>> Found by Linux Driver Verification project (linuxtesting.org).
>>
>> Signed-off-by: Alexey Khoroshilov <[email protected]>
>
> Actually, the worse thing is that it leaves the IRQ enabled...it's good
> you moved that lines down. Even better, of course, that the failure path
> has probably never been run during the life of this driver...:)

And hopefully it will not, but we will be ready:)

>
> Should there be some sort of proper reported-by line for the driver
> verification project?

Till now, we used "Found by" line, but we are open to any better way.

>
> Acked-by: Jonathan Corbet <[email protected]>

--
Alexey