linux-kernel - [PATCH] Input: ili210x: Fix potential memory leaks

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Tue,  4 Aug 2020 13:30:07 -0500
From:   Adam Ford <aford173@...il.com>
To:     linux-input@...r.kernel.org
Cc:     dmitry.torokhov@...il.com, linux-kernel@...r.kernel.org,
        Adam Ford <aford173@...il.com>
Subject: [PATCH] Input: ili210x: Fix potential memory leaks

This driver requests, memory twice and requests a threaded irq, but
it doesn't free any of them if something fails.

This patch attempts to identify areas where a return was issued
without freeing allocated memory or IRQ's.

Signed-off-by: Adam Ford <aford173@...il.com>

diff --git a/drivers/input/touchscreen/ili210x.c b/drivers/input/touchscreen/ili210x.c
index 199cf3daec10..967329fbdde3 100644
--- a/drivers/input/touchscreen/ili210x.c
+++ b/drivers/input/touchscreen/ili210x.c
@@ -421,7 +421,7 @@ static int ili210x_i2c_probe(struct i2c_client *client,
 
 	input = devm_input_allocate_device(dev);
 	if (!input)
-		return -ENOMEM;
+		goto free_priv;
 
 	priv->client = client;
 	priv->input = input;
@@ -443,7 +443,7 @@ static int ili210x_i2c_probe(struct i2c_client *client,
 				    INPUT_MT_DIRECT);
 	if (error) {
 		dev_err(dev, "Unable to set up slots, err: %d\n", error);
-		return error;
+		goto free_input;
 	}
 
 	error = devm_request_threaded_irq(dev, client->irq, NULL, ili210x_irq,
@@ -451,27 +451,36 @@ static int ili210x_i2c_probe(struct i2c_client *client,
 	if (error) {
 		dev_err(dev, "Unable to request touchscreen IRQ, err: %d\n",
 			error);
-		return error;
+		goto free_input;
 	}
 
 	error = devm_add_action_or_reset(dev, ili210x_stop, priv);
 	if (error)
-		return error;
+		goto free_irq;
 
 	error = devm_device_add_group(dev, &ili210x_attr_group);
 	if (error) {
 		dev_err(dev, "Unable to create sysfs attributes, err: %d\n",
 			error);
-		return error;
+		goto free_irq;
 	}
 
 	error = input_register_device(priv->input);
 	if (error) {
 		dev_err(dev, "Cannot register input device, err: %d\n", error);
-		return error;
+		goto free_irq;
 	}
 
 	return 0;
+
+free_irq:
+	free_irq(client->irq, client);
+free_input:
+	input_free_device(input);
+free_priv:
+	kfree(priv);
+
+	return error;
 }
 
 static const struct i2c_device_id ili210x_i2c_id[] = {
-- 
2.25.1