Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752168AbdIVNQ2 (ORCPT ); Fri, 22 Sep 2017 09:16:28 -0400 Received: from mail-io0-f178.google.com ([209.85.223.178]:49434 "EHLO mail-io0-f178.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751909AbdIVNQ0 (ORCPT ); Fri, 22 Sep 2017 09:16:26 -0400 X-Google-Smtp-Source: AOwi7QBvAov3NzVKlD+bJlC/11G8qjdBpylngyPQZVI8RFott4amZXx04iNzwgDpyAqEjEYM65CF7XyWPRqaCuQt5pg= MIME-Version: 1.0 In-Reply-To: References: From: Andrey Konovalov Date: Fri, 22 Sep 2017 15:16:24 +0200 Message-ID: Subject: Re: [PATCH] [media] hdpvr: Fix an error handling path in hdpvr_probe() To: Arvind Yadav Cc: Hans Verkuil , Mauro Carvalho Chehab , Laurent Pinchart , Dmitry Vyukov , Kostya Serebryany , syzkaller , linux-media@vger.kernel.org, LKML Content-Type: text/plain; charset="UTF-8" Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 3665 Lines: 101 On Fri, Sep 22, 2017 at 3:07 PM, Arvind Yadav wrote: > Here, hdpvr_register_videodev() is responsible for setup and > register a video device. Also defining and initializing a worker. > hdpvr_register_videodev() is calling by hdpvr_probe at last. > So No need to flash any work here. > Unregister v4l2, free buffers and memory. If hdpvr_probe() will fail. > > Signed-off-by: Arvind Yadav Reported-by: Andrey Konovalov Thanks, this fixes the crash! Tested-by: Andrey Konovalov > --- > drivers/media/usb/hdpvr/hdpvr-core.c | 26 +++++++++++++++----------- > 1 file changed, 15 insertions(+), 11 deletions(-) > > diff --git a/drivers/media/usb/hdpvr/hdpvr-core.c b/drivers/media/usb/hdpvr/hdpvr-core.c > index dbe29c6..1e8cbaf 100644 > --- a/drivers/media/usb/hdpvr/hdpvr-core.c > +++ b/drivers/media/usb/hdpvr/hdpvr-core.c > @@ -292,7 +292,7 @@ static int hdpvr_probe(struct usb_interface *interface, > /* register v4l2_device early so it can be used for printks */ > if (v4l2_device_register(&interface->dev, &dev->v4l2_dev)) { > dev_err(&interface->dev, "v4l2_device_register failed\n"); > - goto error; > + goto error_free_dev; > } > > mutex_init(&dev->io_mutex); > @@ -301,7 +301,7 @@ static int hdpvr_probe(struct usb_interface *interface, > dev->usbc_buf = kmalloc(64, GFP_KERNEL); > if (!dev->usbc_buf) { > v4l2_err(&dev->v4l2_dev, "Out of memory\n"); > - goto error; > + goto error_v4l2_unregister; > } > > init_waitqueue_head(&dev->wait_buffer); > @@ -339,13 +339,13 @@ static int hdpvr_probe(struct usb_interface *interface, > } > if (!dev->bulk_in_endpointAddr) { > v4l2_err(&dev->v4l2_dev, "Could not find bulk-in endpoint\n"); > - goto error; > + goto error_put_usb; > } > > /* init the device */ > if (hdpvr_device_init(dev)) { > v4l2_err(&dev->v4l2_dev, "device init failed\n"); > - goto error; > + goto error_put_usb; > } > > mutex_lock(&dev->io_mutex); > @@ -353,7 +353,7 @@ static int hdpvr_probe(struct usb_interface *interface, > mutex_unlock(&dev->io_mutex); > v4l2_err(&dev->v4l2_dev, > "allocating transfer buffers failed\n"); > - goto error; > + goto error_put_usb; > } > mutex_unlock(&dev->io_mutex); > > @@ -361,7 +361,7 @@ static int hdpvr_probe(struct usb_interface *interface, > retval = hdpvr_register_i2c_adapter(dev); > if (retval < 0) { > v4l2_err(&dev->v4l2_dev, "i2c adapter register failed\n"); > - goto error; > + goto error_free_buffers; > } > > client = hdpvr_register_ir_rx_i2c(dev); > @@ -394,13 +394,17 @@ static int hdpvr_probe(struct usb_interface *interface, > reg_fail: > #if IS_ENABLED(CONFIG_I2C) > i2c_del_adapter(&dev->i2c_adapter); > +error_free_buffers: > #endif > + hdpvr_free_buffers(dev); > +error_put_usb: > + usb_put_dev(dev->udev); > + kfree(dev->usbc_buf); > +error_v4l2_unregister: > + v4l2_device_unregister(&dev->v4l2_dev); > +error_free_dev: > + kfree(dev); > error: > - if (dev) { > - flush_work(&dev->worker); > - /* this frees allocated memory */ > - hdpvr_delete(dev); > - } > return retval; > } > > -- > 1.9.1 >