From patchwork Wed May 29 20:12:23 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andy Shevchenko X-Patchwork-Id: 2632591 X-Patchwork-Delegate: jikos@jikos.cz Return-Path: X-Original-To: patchwork-linux-input@patchwork.kernel.org Delivered-To: patchwork-process-083081@patchwork2.kernel.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by patchwork2.kernel.org (Postfix) with ESMTP id ABD91DF24C for ; Wed, 29 May 2013 20:21:20 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S966890Ab3E2UUz (ORCPT ); Wed, 29 May 2013 16:20:55 -0400 Received: from gw01.mail.saunalahti.fi ([195.197.172.115]:58795 "EHLO gw01.mail.saunalahti.fi" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S966874Ab3E2UUt (ORCPT ); Wed, 29 May 2013 16:20:49 -0400 X-Greylist: delayed 473 seconds by postgrey-1.27 at vger.kernel.org; Wed, 29 May 2013 16:20:48 EDT Received: from localhost.localdomain (a91-152-110-56.elisa-laajakaista.fi [91.152.110.56]) by gw01.mail.saunalahti.fi (Postfix) with ESMTP id 67AEA1515E7; Wed, 29 May 2013 23:12:45 +0300 (EEST) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by localhost.localdomain (8.14.5/8.14.5) with ESMTP id r4TKCR0D000730; Wed, 29 May 2013 23:12:27 +0300 Received: (from andy@localhost) by localhost.localdomain (8.14.5/8.14.5/Submit) id r4TKCPOp000728; Wed, 29 May 2013 23:12:25 +0300 X-Authentication-Warning: localhost.localdomain: andy set sender to andy.shevchenko@gmail.com using -f From: Andy Shevchenko To: linux-input@vger.kernel.org, Jiri Kosina , Benjamin Tissoires , Henrik Rydberg , Stephane Chatty , linux-kernel@vger.kernel.org Cc: Andy Shevchenko Subject: [PATCH] HID: multitouch: prevent memleak with the allocated name Date: Wed, 29 May 2013 23:12:23 +0300 Message-Id: <1369858343-681-1-git-send-email-andy.shevchenko@gmail.com> X-Mailer: git-send-email 1.7.7.6 In-Reply-To: <1369817109-4277-1-git-send-email-benjamin.tissoires@redhat.com> References: <1369817109-4277-1-git-send-email-benjamin.tissoires@redhat.com> Sender: linux-input-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-input@vger.kernel.org mt_free_input_name() was never called during .remove(): hid_hw_stop() removes the hid_input items in hdev->inputs, and so the list is therefore empty after the call. In the end, we never free the special names that has been allocated during .probe(). We switch to devm_kzalloc that manages resources when driver is removed. Signed-off-by: Andy Shevchenko Reported-by: Benjamin Tissoires --- drivers/hid/hid-multitouch.c | 37 +++++++++++++------------------------ 1 files changed, 13 insertions(+), 24 deletions(-) diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c index d99b959..1f5876e 100644 --- a/drivers/hid/hid-multitouch.c +++ b/drivers/hid/hid-multitouch.c @@ -261,14 +261,6 @@ static struct mt_class mt_classes[] = { { } }; -static void mt_free_input_name(struct hid_input *hi) -{ - struct hid_device *hdev = hi->report->device; - - if (hi->input->name != hdev->name) - kfree(hi->input->name); -} - static ssize_t mt_show_quirks(struct device *dev, struct device_attribute *attr, char *buf) @@ -412,10 +404,12 @@ static void mt_pen_report(struct hid_device *hid, struct hid_report *report) static void mt_pen_input_configured(struct hid_device *hdev, struct hid_input *hi) { - char *name = kzalloc(strlen(hi->input->name) + 5, GFP_KERNEL); - if (name) { - sprintf(name, "%s Pen", hi->input->name); - mt_free_input_name(hi); + char *name; + + if (hdev->name) { + name = devm_kzalloc(&hdev->dev, strlen(hdev->name) + 5, + GFP_KERNEL); + sprintf(name, "%s Pen", hdev->name); hi->input->name = name; } @@ -925,16 +919,18 @@ static void mt_post_parse(struct mt_device *td) static void mt_input_configured(struct hid_device *hdev, struct hid_input *hi) { struct mt_device *td = hid_get_drvdata(hdev); - char *name = kstrdup(hdev->name, GFP_KERNEL); - - if (name) - hi->input->name = name; if (hi->report->id == td->mt_report_id) mt_touch_input_configured(hdev, hi); if (hi->report->id == td->pen_report_id) mt_pen_input_configured(hdev, hi); + + if (!hi->input->name) { + hi->input->name = devm_kzalloc(&hdev->dev, + strlen(hdev->name) + 1, GFP_KERNEL); + strcpy(hi->input->name, hdev->name); + } } static int mt_probe(struct hid_device *hdev, const struct hid_device_id *id) @@ -993,7 +989,7 @@ static int mt_probe(struct hid_device *hdev, const struct hid_device_id *id) ret = hid_hw_start(hdev, HID_CONNECT_DEFAULT); if (ret) - goto hid_fail; + goto fail; ret = sysfs_create_group(&hdev->dev.kobj, &mt_attribute_group); @@ -1005,9 +1001,6 @@ static int mt_probe(struct hid_device *hdev, const struct hid_device_id *id) return 0; -hid_fail: - list_for_each_entry(hi, &hdev->inputs, list) - mt_free_input_name(hi); fail: kfree(td->fields); kfree(td); @@ -1037,14 +1030,10 @@ static int mt_resume(struct hid_device *hdev) static void mt_remove(struct hid_device *hdev) { struct mt_device *td = hid_get_drvdata(hdev); - struct hid_input *hi; sysfs_remove_group(&hdev->dev.kobj, &mt_attribute_group); hid_hw_stop(hdev); - list_for_each_entry(hi, &hdev->inputs, list) - mt_free_input_name(hi); - kfree(td); hid_set_drvdata(hdev, NULL); }