linux-kernel - [PATCH] Input: omap4-keypad: fix ref count leak if pm_runtime_get

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Sun, 14 Jun 2020 00:52:07 -0500
From:   Navid Emamdoost <navid.emamdoost@...il.com>
To:     Dmitry Torokhov <dmitry.torokhov@...il.com>,
        Navid Emamdoost <navid.emamdoost@...il.com>,
        linux-input@...r.kernel.org, linux-kernel@...r.kernel.org
Cc:     emamd001@....edu, wu000273@....edu, kjlu@....edu, smccaman@....edu
Subject: [PATCH] Input: omap4-keypad: fix ref count leak if pm_runtime_get_sync fails

calling pm_runtime_get_sync increments the counter even in case of
failure, leading to incorrect ref count. In case of failure, decrement
the ref count before returning.

Signed-off-by: Navid Emamdoost <navid.emamdoost@...il.com>
---
 drivers/input/keyboard/omap4-keypad.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/input/keyboard/omap4-keypad.c b/drivers/input/keyboard/omap4-keypad.c
index 94c94d7f5155..35ac788d9fa0 100644
--- a/drivers/input/keyboard/omap4-keypad.c
+++ b/drivers/input/keyboard/omap4-keypad.c
@@ -280,7 +280,7 @@ static int omap4_keypad_probe(struct platform_device *pdev)
 	error = pm_runtime_get_sync(&pdev->dev);
 	if (error) {
 		dev_err(&pdev->dev, "pm_runtime_get_sync() failed\n");
-		goto err_unmap;
+		goto err_pm_put_sync;
 	}
 	rev = __raw_readl(keypad_data->base + OMAP4_KBD_REVISION);
 	rev &= 0x03 << 30;
@@ -372,7 +372,6 @@ static int omap4_keypad_probe(struct platform_device *pdev)
 	input_free_device(input_dev);
 err_pm_put_sync:
 	pm_runtime_put_sync(&pdev->dev);
-err_unmap:
 	iounmap(keypad_data->base);
 err_release_mem:
 	release_mem_region(res->start, resource_size(res));
-- 
2.17.1