linux-kernel - Re: [PATCH] Input: davinci_keyscan: Free memory occupied by davinci key scan device

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 14 Nov 2017 10:14:34 -0800
From:   Dmitry Torokhov <dmitry.torokhov@...il.com>
To:     Arvind Yadav <arvind.yadav.cs@...il.com>
Cc:     linux@...ck-us.net, linux-kernel@...r.kernel.org,
        linux-input@...r.kernel.org
Subject: Re: [PATCH] Input: davinci_keyscan: Free memory occupied by davinci
 key scan device

On Tue, Nov 14, 2017 at 07:15:14PM +0530, Arvind Yadav wrote:
> Here, key_dev is NULL in input_free_device() and It will not free
> memory occupied by davinci key scan device. Move "key_dev = NULL"
> after input_free_device().

No, this is absolutely wrong. It is disallowed to call
input_free_device() after calling input_unregister_device(), because
input core will free the device once the last reference is dropped. That
is why we set "key_dev" to NULL to turn input_free_device() into a noop.

> 
> Signed-off-by: Arvind Yadav <arvind.yadav.cs@...il.com>
> ---
>  drivers/input/keyboard/davinci_keyscan.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/input/keyboard/davinci_keyscan.c b/drivers/input/keyboard/davinci_keyscan.c
> index b20a5d0..22cb8d2 100644
> --- a/drivers/input/keyboard/davinci_keyscan.c
> +++ b/drivers/input/keyboard/davinci_keyscan.c
> @@ -290,13 +290,13 @@ static int __init davinci_ks_probe(struct platform_device *pdev)
>  	free_irq(davinci_ks->irq, davinci_ks);
>  fail5:
>  	input_unregister_device(davinci_ks->input);
> -	key_dev = NULL;
>  fail4:
>  	iounmap(davinci_ks->base);
>  fail3:
>  	release_mem_region(davinci_ks->pbase, davinci_ks->base_size);
>  fail2:
>  	input_free_device(key_dev);
> +	key_dev = NULL;
>  fail1:
>  	kfree(davinci_ks);
>  
> -- 
> 1.9.1
> 

Thanks.

-- 
Dmitry