Input: ili210x: Fix potential memory leaks

Commit Message

Adam Ford Aug. 4, 2020, 6:30 p.m. UTC

This driver requests, memory twice and requests a threaded irq, but
it doesn't free any of them if something fails.

This patch attempts to identify areas where a return was issued
without freeing allocated memory or IRQ's.

Signed-off-by: Adam Ford <[e-mail]>

Comments

Marco Felsch Aug. 5, 2020, 7:50 a.m. UTC | #1

Hi Adam,

On 20-08-04 13:30, Adam Ford wrote:
> This driver requests, memory twice and requests a threaded irq, but
> it doesn't free any of them if something fails.

Free'ing is done automatically because the driver uses devres
(identified by devm_ prepfix) functions.

Regards,
  Marco

Patch

diff --git a/drivers/input/touchscreen/ili210x.c b/drivers/input/touchscreen/ili210x.c
index 199cf3daec10..967329fbdde3 100644
--- a/drivers/input/touchscreen/ili210x.c
+++ b/drivers/input/touchscreen/ili210x.c
@@ -421,7 +421,7 @@  static int ili210x_i2c_probe(struct i2c_client *client,
 
 	input = devm_input_allocate_device(dev);
 	if (!input)
-		return -ENOMEM;
+		goto free_priv;
 
 	priv->client = client;
 	priv->input = input;
@@ -443,7 +443,7 @@  static int ili210x_i2c_probe(struct i2c_client *client,
 				    INPUT_MT_DIRECT);
 	if (error) {
 		dev_err(dev, "Unable to set up slots, err: %d\n", error);
-		return error;
+		goto free_input;
 	}
 
 	error = devm_request_threaded_irq(dev, client->irq, NULL, ili210x_irq,
@@ -451,27 +451,36 @@  static int ili210x_i2c_probe(struct i2c_client *client,
 	if (error) {
 		dev_err(dev, "Unable to request touchscreen IRQ, err: %d\n",
 			error);
-		return error;
+		goto free_input;
 	}
 
 	error = devm_add_action_or_reset(dev, ili210x_stop, priv);
 	if (error)
-		return error;
+		goto free_irq;
 
 	error = devm_device_add_group(dev, &ili210x_attr_group);
 	if (error) {
 		dev_err(dev, "Unable to create sysfs attributes, err: %d\n",
 			error);
-		return error;
+		goto free_irq;
 	}
 
 	error = input_register_device(priv->input);
 	if (error) {
 		dev_err(dev, "Cannot register input device, err: %d\n", error);
-		return error;
+		goto free_irq;
 	}
 
 	return 0;
+
+free_irq:
+	free_irq(client->irq, client);
+free_input:
+	input_free_device(input);
+free_priv:
+	kfree(priv);
+
+	return error;
 }
 
 static const struct i2c_device_id ili210x_i2c_id[] = {