2022-12-20 12:35:47

by Miaoqian Lin

Subject: [PATCH] input: raspberrypi-ts: Fix refcount leak in rpi_ts_probe

rpi_firmware_get() take reference, we need to release it in error paths
as well. Add missing rpi_firmware_put() in the error handling to fix it.

Fixes: 0b9f28fed3f7 ("Input: add official Raspberry Pi's touchscreen driver")
Fixes: 3b8ddff780b7 ("input: raspberrypi-ts: Release firmware handle when not needed")
Signed-off-by: Miaoqian Lin <[email protected]>
---
drivers/input/touchscreen/raspberrypi-ts.c | 15 +++++++++++----
1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/drivers/input/touchscreen/raspberrypi-ts.c b/drivers/input/touchscreen/raspberrypi-ts.c
index 5000f5fd9ec3..114237c76378 100644
--- a/drivers/input/touchscreen/raspberrypi-ts.c
+++ b/drivers/input/touchscreen/raspberrypi-ts.c
@@ -140,21 +140,24 @@ static int rpi_ts_probe(struct platform_device *pdev)
return -EPROBE_DEFER;

ts = devm_kzalloc(dev, sizeof(*ts), GFP_KERNEL);
- if (!ts)
- return -ENOMEM;
+ if (!ts) {
+ error = -ENOMEM;
+ goto err_put_fw;
+ }
ts->pdev = pdev;

ts->fw_regs_va = dma_alloc_coherent(dev, PAGE_SIZE, &ts->fw_regs_phys,
GFP_KERNEL);
if (!ts->fw_regs_va) {
dev_err(dev, "failed to dma_alloc_coherent\n");
- return -ENOMEM;
+ error = -ENOMEM;
+ goto err_put_fw;
}

error = devm_add_action_or_reset(dev, rpi_ts_dma_cleanup, ts);
if (error) {
dev_err(dev, "failed to devm_add_action_or_reset, %d\n", error);
- return error;
+ goto err_put_fw;
}

touchbuf = (u32)ts->fw_regs_phys;
@@ -206,6 +209,10 @@ static int rpi_ts_probe(struct platform_device *pdev)
}

return 0;
+
+err_put_fw:
+ rpi_firmware_put(fw);
+ return error;
}

static const struct of_device_id rpi_ts_match[] = {
--
2.25.1

2022-12-20 19:30:31

by Dmitry Torokhov

Subject: Re: [PATCH] input: raspberrypi-ts: Fix refcount leak in rpi_ts_probe

On Tue, Dec 20, 2022 at 03:52:43PM +0400, Miaoqian Lin wrote:
> rpi_firmware_get() take reference, we need to release it in error paths
> as well. Add missing rpi_firmware_put() in the error handling to fix it.

Hmm, it used not to take a reference, but now it does... OK.

But I see there is devm_rpi_firmware_get() variant, we should be using
it instead of mixing up manual and devm-controller resources to ensure
proper release order.

Thanks.

--
Dmitry