2020-08-04 18:31:56

by Adam Ford

Subject: [PATCH] Input: ili210x: Fix potential memory leaks

This driver requests, memory twice and requests a threaded irq, but
it doesn't free any of them if something fails.

This patch attempts to identify areas where a return was issued
without freeing allocated memory or IRQ's.

Signed-off-by: Adam Ford <[email protected]>

diff --git a/drivers/input/touchscreen/ili210x.c b/drivers/input/touchscreen/ili210x.c
index 199cf3daec10..967329fbdde3 100644
--- a/drivers/input/touchscreen/ili210x.c
+++ b/drivers/input/touchscreen/ili210x.c
@@ -421,7 +421,7 @@ static int ili210x_i2c_probe(struct i2c_client *client,

input = devm_input_allocate_device(dev);
if (!input)
- return -ENOMEM;
+ goto free_priv;

priv->client = client;
priv->input = input;
@@ -443,7 +443,7 @@ static int ili210x_i2c_probe(struct i2c_client *client,
INPUT_MT_DIRECT);
if (error) {
dev_err(dev, "Unable to set up slots, err: %d\n", error);
- return error;
+ goto free_input;
}

error = devm_request_threaded_irq(dev, client->irq, NULL, ili210x_irq,
@@ -451,27 +451,36 @@ static int ili210x_i2c_probe(struct i2c_client *client,
if (error) {
dev_err(dev, "Unable to request touchscreen IRQ, err: %d\n",
error);
- return error;
+ goto free_input;
}

error = devm_add_action_or_reset(dev, ili210x_stop, priv);
if (error)
- return error;
+ goto free_irq;

error = devm_device_add_group(dev, &ili210x_attr_group);
if (error) {
dev_err(dev, "Unable to create sysfs attributes, err: %d\n",
error);
- return error;
+ goto free_irq;
}

error = input_register_device(priv->input);
if (error) {
dev_err(dev, "Cannot register input device, err: %d\n", error);
- return error;
+ goto free_irq;
}

return 0;
+
+free_irq:
+ free_irq(client->irq, client);
+free_input:
+ input_free_device(input);
+free_priv:
+ kfree(priv);
+
+ return error;
}

static const struct i2c_device_id ili210x_i2c_id[] = {
--
2.25.1

2020-08-05 07:51:20

by Marco Felsch

Subject: Re: [PATCH] Input: ili210x: Fix potential memory leaks

Hi Adam,

On 20-08-04 13:30, Adam Ford wrote:
> This driver requests, memory twice and requests a threaded irq, but
> it doesn't free any of them if something fails.

Free'ing is done automatically because the driver uses devres
(identified by devm_ prepfix) functions.

Regards,
Marco