| Message ID | 20200614055604.67969-1-navid.emamdoost@gmail.com (mailing list archive) |
|---|---|
| State | Superseded |
| Headers | show |
| Series | Input: bma150: fix ref count leak in bma150_open | expand |
On Sun, Jun 14, 2020 at 8:58 AM Navid Emamdoost <navid.emamdoost@gmail.com> wrote: > > in bma150_open, pm_runtime_get_sync is called which > increments the counter even in case of failure, leading to incorrect > ref count. In case of failure, decrement the ref count before returning. ... > error = pm_runtime_get_sync(&bma150->client->dev); > if (error < 0 && error != -ENOSYS) > - return error; > + goto out; So, what will happen in case of -ENOSYS? ... > + pm_runtime_put(&bma150->client->dev); Slightly better to use _put_noidle(). (More consistency with error path)
On Sun, Jun 14, 2020 at 4:27 AM Andy Shevchenko <andy.shevchenko@gmail.com> wrote: > > On Sun, Jun 14, 2020 at 8:58 AM Navid Emamdoost > <navid.emamdoost@gmail.com> wrote: > > > > in bma150_open, pm_runtime_get_sync is called which > > increments the counter even in case of failure, leading to incorrect > > ref count. In case of failure, decrement the ref count before returning. > > ... > > > error = pm_runtime_get_sync(&bma150->client->dev); > > if (error < 0 && error != -ENOSYS) > > - return error; > > + goto out; > > So, what will happen in case of -ENOSYS? I'm not sure! > > ... > > > + pm_runtime_put(&bma150->client->dev); > > Slightly better to use _put_noidle(). (More consistency with error path) v2 is sent. > > -- > With Best Regards, > Andy Shevchenko
diff --git a/drivers/input/misc/bma150.c b/drivers/input/misc/bma150.c index a9d984da95f3..e2f1b05fcb2a 100644 --- a/drivers/input/misc/bma150.c +++ b/drivers/input/misc/bma150.c @@ -348,7 +348,7 @@ static int bma150_open(struct input_dev *input) error = pm_runtime_get_sync(&bma150->client->dev); if (error < 0 && error != -ENOSYS) - return error; + goto out; /* * See if runtime PM woke up the device. If runtime PM @@ -357,10 +357,13 @@ static int bma150_open(struct input_dev *input) if (bma150->mode != BMA150_MODE_NORMAL) { error = bma150_set_mode(bma150, BMA150_MODE_NORMAL); if (error) - return error; + goto out; } return 0; +out: + pm_runtime_put(&bma150->client->dev); + return error; } static void bma150_close(struct input_dev *input)
in bma150_open, pm_runtime_get_sync is called which increments the counter even in case of failure, leading to incorrect ref count. In case of failure, decrement the ref count before returning. Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com> --- drivers/input/misc/bma150.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)