Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   Adam Ford <aford173@gmail.com>
To:     linux-input@vger.kernel.org
Cc:     dmitry.torokhov@gmail.com, linux-kernel@vger.kernel.org,
        Adam Ford <aford173@gmail.com>
Subject: [PATCH] Input: ili210x: Fix potential memory leaks
Date:   Tue,  4 Aug 2020 13:30:07 -0500
Message-Id: <20200804183007.117125-1-aford173@gmail.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

This driver requests, memory twice and requests a threaded irq, but
it doesn't free any of them if something fails.

This patch attempts to identify areas where a return was issued
without freeing allocated memory or IRQ's.

Signed-off-by: Adam Ford <aford173@gmail.com>

diff --git a/drivers/input/touchscreen/ili210x.c b/drivers/input/touchscreen/ili210x.c
index 199cf3daec10..967329fbdde3 100644
--- a/drivers/input/touchscreen/ili210x.c
+++ b/drivers/input/touchscreen/ili210x.c
@@ -421,7 +421,7 @@ static int ili210x_i2c_probe(struct i2c_client *client,
 
 	input = devm_input_allocate_device(dev);
 	if (!input)
-		return -ENOMEM;
+		goto free_priv;
 
 	priv->client = client;
 	priv->input = input;
@@ -443,7 +443,7 @@ static int ili210x_i2c_probe(struct i2c_client *client,
 				    INPUT_MT_DIRECT);
 	if (error) {
 		dev_err(dev, "Unable to set up slots, err: %d\n", error);
-		return error;
+		goto free_input;
 	}
 
 	error = devm_request_threaded_irq(dev, client->irq, NULL, ili210x_irq,
@@ -451,27 +451,36 @@ static int ili210x_i2c_probe(struct i2c_client *client,
 	if (error) {
 		dev_err(dev, "Unable to request touchscreen IRQ, err: %d\n",
 			error);
-		return error;
+		goto free_input;
 	}
 
 	error = devm_add_action_or_reset(dev, ili210x_stop, priv);
 	if (error)
-		return error;
+		goto free_irq;
 
 	error = devm_device_add_group(dev, &ili210x_attr_group);
 	if (error) {
 		dev_err(dev, "Unable to create sysfs attributes, err: %d\n",
 			error);
-		return error;
+		goto free_irq;
 	}
 
 	error = input_register_device(priv->input);
 	if (error) {
 		dev_err(dev, "Cannot register input device, err: %d\n", error);
-		return error;
+		goto free_irq;
 	}
 
 	return 0;
+
+free_irq:
+	free_irq(client->irq, client);
+free_input:
+	input_free_device(input);
+free_priv:
+	kfree(priv);
+
+	return error;
 }
 
 static const struct i2c_device_id ili210x_i2c_id[] = {
-- 
2.25.1