* [PATCH] [media] mceusb: fix usbdev leak
@ 2014-09-08 22:10 Alexey Khoroshilov
2014-09-09 10:39 ` Sean Young
0 siblings, 1 reply; 4+ messages in thread
From: Alexey Khoroshilov @ 2014-09-08 22:10 UTC (permalink / raw)
To: Mauro Carvalho Chehab
Cc: Alexey Khoroshilov, Sean Young, linux-media, linux-kernel, ldv-project
mceusb_init_rc_dev() does usb_get_dev(), but there is no any
usb_put_dev() in the driver.
The patch tries to straighten logic. It moves usb_get_dev()
directly to mceusb_dev_probe() and adds usb_put_dev() to an error path
and to mceusb_dev_disconnect().
Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
---
drivers/media/rc/mceusb.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
diff --git a/drivers/media/rc/mceusb.c b/drivers/media/rc/mceusb.c
index 45b0894288e5..23e532da0cf7 100644
--- a/drivers/media/rc/mceusb.c
+++ b/drivers/media/rc/mceusb.c
@@ -1198,10 +1198,9 @@ static void mceusb_flash_led(struct mceusb_dev *ir)
mce_async_out(ir, FLASH_LED, sizeof(FLASH_LED));
}
-static struct rc_dev *mceusb_init_rc_dev(struct mceusb_dev *ir,
- struct usb_interface *intf)
+static struct rc_dev *mceusb_init_rc_dev(struct mceusb_dev *ir)
{
- struct usb_device *udev = usb_get_dev(interface_to_usbdev(intf));
+ struct usb_device *udev = ir->usbdev;
struct device *dev = ir->dev;
struct rc_dev *rc;
int ret;
@@ -1341,7 +1340,7 @@ static int mceusb_dev_probe(struct usb_interface *intf,
if (!ir->urb_in)
goto urb_in_alloc_fail;
- ir->usbdev = dev;
+ ir->usbdev = usb_get_dev(dev);
ir->dev = &intf->dev;
ir->len_in = maxp;
ir->flags.microsoft_gen1 = is_microsoft_gen1;
@@ -1362,7 +1361,7 @@ static int mceusb_dev_probe(struct usb_interface *intf,
snprintf(name + strlen(name), sizeof(name) - strlen(name),
" %s", buf);
- ir->rc = mceusb_init_rc_dev(ir, intf);
+ ir->rc = mceusb_init_rc_dev(ir);
if (!ir->rc)
goto rc_dev_fail;
@@ -1408,6 +1407,7 @@ static int mceusb_dev_probe(struct usb_interface *intf,
/* Error-handling path */
rc_dev_fail:
+ usb_put_dev(ir->usbdev);
usb_free_urb(ir->urb_in);
urb_in_alloc_fail:
usb_free_coherent(dev, maxp, ir->buf_in, ir->dma_in);
@@ -1435,6 +1435,7 @@ static void mceusb_dev_disconnect(struct usb_interface *intf)
usb_kill_urb(ir->urb_in);
usb_free_urb(ir->urb_in);
usb_free_coherent(dev, ir->len_in, ir->buf_in, ir->dma_in);
+ usb_put_dev(dev);
kfree(ir);
}
--
1.9.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH] [media] mceusb: fix usbdev leak
2014-09-08 22:10 [PATCH] [media] mceusb: fix usbdev leak Alexey Khoroshilov
@ 2014-09-09 10:39 ` Sean Young
2014-09-10 15:07 ` Alexey Khoroshilov
0 siblings, 1 reply; 4+ messages in thread
From: Sean Young @ 2014-09-09 10:39 UTC (permalink / raw)
To: Alexey Khoroshilov
Cc: Mauro Carvalho Chehab, linux-media, linux-kernel, ldv-project
On Tue, Sep 09, 2014 at 02:10:43AM +0400, Alexey Khoroshilov wrote:
> mceusb_init_rc_dev() does usb_get_dev(), but there is no any
> usb_put_dev() in the driver.
drivers/media/rc/imon.c suffers from the same problem.
Thanks
Sean
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] [media] mceusb: fix usbdev leak
2014-09-09 10:39 ` Sean Young
@ 2014-09-10 15:07 ` Alexey Khoroshilov
2014-09-15 21:36 ` [PATCH] [media] imon: fix usbdev leaks Alexey Khoroshilov
0 siblings, 1 reply; 4+ messages in thread
From: Alexey Khoroshilov @ 2014-09-10 15:07 UTC (permalink / raw)
To: Sean Young; +Cc: Mauro Carvalho Chehab, linux-media, linux-kernel, ldv-project
On 09.09.2014 14:39, Sean Young wrote:
> On Tue, Sep 09, 2014 at 02:10:43AM +0400, Alexey Khoroshilov wrote:
>> mceusb_init_rc_dev() does usb_get_dev(), but there is no any
>> usb_put_dev() in the driver.
> drivers/media/rc/imon.c suffers from the same problem.
>
> Thanks
> Sean
Yes, our static analyzers show that as well.
We will prepare a patch soon, if nobody has done it yet.
Thanks,
Alexey
^ permalink raw reply [flat|nested] 4+ messages in thread
* [PATCH] [media] imon: fix usbdev leaks
2014-09-10 15:07 ` Alexey Khoroshilov
@ 2014-09-15 21:36 ` Alexey Khoroshilov
0 siblings, 0 replies; 4+ messages in thread
From: Alexey Khoroshilov @ 2014-09-15 21:36 UTC (permalink / raw)
To: Mauro Carvalho Chehab
Cc: Alexey Khoroshilov, Kevin Baradon, Sean Young, linux-media,
linux-kernel, ldv-project
imon_probe() does three usb_get_dev(), but there is no any
usb_put_dev() in the driver.
The patch adds usb_put_dev() to error paths, to imon_disconnect()
and to imon_probe() as far as usbdev is not saved anywhere.
Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
---
drivers/media/rc/imon.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/media/rc/imon.c b/drivers/media/rc/imon.c
index 7115e68ba697..06ff61ec3e1e 100644
--- a/drivers/media/rc/imon.c
+++ b/drivers/media/rc/imon.c
@@ -2181,6 +2181,7 @@ idev_setup_failed:
usb_kill_urb(ictx->rx_urb_intf0);
urb_submit_failed:
find_endpoint_failed:
+ usb_put_dev(ictx->usbdev_intf0);
mutex_unlock(&ictx->lock);
usb_free_urb(tx_urb);
tx_urb_alloc_failed:
@@ -2253,6 +2254,7 @@ urb_submit_failed:
input_unregister_device(ictx->touch);
touch_setup_failed:
find_endpoint_failed:
+ usb_put_dev(ictx->usbdev_intf1);
mutex_unlock(&ictx->lock);
usb_free_urb(rx_urb);
rx_urb_alloc_failed:
@@ -2366,11 +2368,13 @@ static int imon_probe(struct usb_interface *interface,
usbdev->bus->busnum, usbdev->devnum);
mutex_unlock(&driver_lock);
+ usb_put_dev(usbdev);
return 0;
fail:
mutex_unlock(&driver_lock);
+ usb_put_dev(usbdev);
dev_err(dev, "unable to register, err %d\n", ret);
return ret;
@@ -2410,6 +2414,7 @@ static void imon_disconnect(struct usb_interface *interface)
if (ifnum == 0) {
ictx->dev_present_intf0 = false;
usb_kill_urb(ictx->rx_urb_intf0);
+ usb_put_dev(ictx->usbdev_intf0);
input_unregister_device(ictx->idev);
rc_unregister_device(ictx->rdev);
if (ictx->display_supported) {
@@ -2421,6 +2426,7 @@ static void imon_disconnect(struct usb_interface *interface)
} else {
ictx->dev_present_intf1 = false;
usb_kill_urb(ictx->rx_urb_intf1);
+ usb_put_dev(ictx->usbdev_intf1);
if (ictx->display_type == IMON_DISPLAY_TYPE_VGA) {
input_unregister_device(ictx->touch);
del_timer_sync(&ictx->ttimer);
--
1.9.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
end of thread, other threads:[~2014-09-15 21:36 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2014-09-08 22:10 [PATCH] [media] mceusb: fix usbdev leak Alexey Khoroshilov
2014-09-09 10:39 ` Sean Young
2014-09-10 15:07 ` Alexey Khoroshilov
2014-09-15 21:36 ` [PATCH] [media] imon: fix usbdev leaks Alexey Khoroshilov
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).