Commit f27b853e authored by Ben Hutchings's avatar Ben Hutchings Committed by Mauro Carvalho Chehab

[media] rc: Fix invalid free_region and/or free_irq on probe failure

fintek-cir, ite-cir and nuvoton-cir may try to free an I/O region
and/or IRQ handler that was never allocated after a failure in their
respective probe functions.  Add and use separate labels on the
failure path so they will do the right cleanup after each possible
point of failure.

Compile-tested only.
Signed-off-by: default avatarBen Hutchings <ben@decadent.org.uk>
Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@redhat.com>
parent 81cda577
...@@ -556,11 +556,11 @@ static int fintek_probe(struct pnp_dev *pdev, const struct pnp_device_id *dev_id ...@@ -556,11 +556,11 @@ static int fintek_probe(struct pnp_dev *pdev, const struct pnp_device_id *dev_id
if (request_irq(fintek->cir_irq, fintek_cir_isr, IRQF_SHARED, if (request_irq(fintek->cir_irq, fintek_cir_isr, IRQF_SHARED,
FINTEK_DRIVER_NAME, (void *)fintek)) FINTEK_DRIVER_NAME, (void *)fintek))
goto failure; goto failure2;
ret = rc_register_device(rdev); ret = rc_register_device(rdev);
if (ret) if (ret)
goto failure; goto failure3;
device_init_wakeup(&pdev->dev, true); device_init_wakeup(&pdev->dev, true);
fintek->rdev = rdev; fintek->rdev = rdev;
...@@ -570,12 +570,11 @@ static int fintek_probe(struct pnp_dev *pdev, const struct pnp_device_id *dev_id ...@@ -570,12 +570,11 @@ static int fintek_probe(struct pnp_dev *pdev, const struct pnp_device_id *dev_id
return 0; return 0;
failure: failure3:
if (fintek->cir_irq)
free_irq(fintek->cir_irq, fintek); free_irq(fintek->cir_irq, fintek);
if (fintek->cir_addr) failure2:
release_region(fintek->cir_addr, fintek->cir_port_len); release_region(fintek->cir_addr, fintek->cir_port_len);
failure:
rc_free_device(rdev); rc_free_device(rdev);
kfree(fintek); kfree(fintek);
......
...@@ -1598,24 +1598,22 @@ static int ite_probe(struct pnp_dev *pdev, const struct pnp_device_id ...@@ -1598,24 +1598,22 @@ static int ite_probe(struct pnp_dev *pdev, const struct pnp_device_id
if (request_irq(itdev->cir_irq, ite_cir_isr, IRQF_SHARED, if (request_irq(itdev->cir_irq, ite_cir_isr, IRQF_SHARED,
ITE_DRIVER_NAME, (void *)itdev)) ITE_DRIVER_NAME, (void *)itdev))
goto failure; goto failure2;
ret = rc_register_device(rdev); ret = rc_register_device(rdev);
if (ret) if (ret)
goto failure; goto failure3;
itdev->rdev = rdev; itdev->rdev = rdev;
ite_pr(KERN_NOTICE, "driver has been successfully loaded\n"); ite_pr(KERN_NOTICE, "driver has been successfully loaded\n");
return 0; return 0;
failure: failure3:
if (itdev->cir_irq)
free_irq(itdev->cir_irq, itdev); free_irq(itdev->cir_irq, itdev);
failure2:
if (itdev->cir_addr)
release_region(itdev->cir_addr, itdev->params.io_region_size); release_region(itdev->cir_addr, itdev->params.io_region_size);
failure:
rc_free_device(rdev); rc_free_device(rdev);
kfree(itdev); kfree(itdev);
......
...@@ -1075,19 +1075,19 @@ static int nvt_probe(struct pnp_dev *pdev, const struct pnp_device_id *dev_id) ...@@ -1075,19 +1075,19 @@ static int nvt_probe(struct pnp_dev *pdev, const struct pnp_device_id *dev_id)
if (request_irq(nvt->cir_irq, nvt_cir_isr, IRQF_SHARED, if (request_irq(nvt->cir_irq, nvt_cir_isr, IRQF_SHARED,
NVT_DRIVER_NAME, (void *)nvt)) NVT_DRIVER_NAME, (void *)nvt))
goto failure; goto failure2;
if (!request_region(nvt->cir_wake_addr, if (!request_region(nvt->cir_wake_addr,
CIR_IOREG_LENGTH, NVT_DRIVER_NAME)) CIR_IOREG_LENGTH, NVT_DRIVER_NAME))
goto failure; goto failure3;
if (request_irq(nvt->cir_wake_irq, nvt_cir_wake_isr, IRQF_SHARED, if (request_irq(nvt->cir_wake_irq, nvt_cir_wake_isr, IRQF_SHARED,
NVT_DRIVER_NAME, (void *)nvt)) NVT_DRIVER_NAME, (void *)nvt))
goto failure; goto failure4;
ret = rc_register_device(rdev); ret = rc_register_device(rdev);
if (ret) if (ret)
goto failure; goto failure5;
device_init_wakeup(&pdev->dev, true); device_init_wakeup(&pdev->dev, true);
nvt->rdev = rdev; nvt->rdev = rdev;
...@@ -1099,17 +1099,15 @@ static int nvt_probe(struct pnp_dev *pdev, const struct pnp_device_id *dev_id) ...@@ -1099,17 +1099,15 @@ static int nvt_probe(struct pnp_dev *pdev, const struct pnp_device_id *dev_id)
return 0; return 0;
failure: failure5:
if (nvt->cir_irq)
free_irq(nvt->cir_irq, nvt);
if (nvt->cir_addr)
release_region(nvt->cir_addr, CIR_IOREG_LENGTH);
if (nvt->cir_wake_irq)
free_irq(nvt->cir_wake_irq, nvt); free_irq(nvt->cir_wake_irq, nvt);
if (nvt->cir_wake_addr) failure4:
release_region(nvt->cir_wake_addr, CIR_IOREG_LENGTH); release_region(nvt->cir_wake_addr, CIR_IOREG_LENGTH);
failure3:
free_irq(nvt->cir_irq, nvt);
failure2:
release_region(nvt->cir_addr, CIR_IOREG_LENGTH);
failure:
rc_free_device(rdev); rc_free_device(rdev);
kfree(nvt); kfree(nvt);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment