linux-kernel - Re: [PATCH] staging: media: atomisp: Fix error path in lm3554

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 3 Sep 2020 15:11:34 +0300
From:   Dan Carpenter <dan.carpenter@...cle.com>
To:     Alex Dewar <alex.dewar90@...il.com>
Cc:     devel@...verdev.osuosl.org,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        Linus Walleij <linus.walleij@...aro.org>,
        linux-media@...r.kernel.org, linux-kernel@...r.kernel.org,
        Sakari Ailus <sakari.ailus@...ux.intel.com>,
        Mauro Carvalho Chehab <mchehab@...nel.org>,
        Alan Cox <alan@...ux.intel.com>
Subject: Re: [PATCH] staging: media: atomisp: Fix error path in lm3554_probe()

On Wed, Sep 02, 2020 at 07:41:50PM +0100, Alex Dewar wrote:
> The error path for lm3554_probe() contains a number of bugs, including:
>  * resource leaks
>  * jumping to error labels out of sequence
>  * not setting the return value appropriately
> 
> Fix it up and give the labels more memorable names.
> 
> This issue has existed since the code was originally contributed in
> commit a49d25364dfb ("staging/atomisp: Add support for the Intel IPU v2"),
> although the code was subsequently removed altogether and then
> reinstated with commit ad85094b293e ("Revert "media: staging: atomisp: Remove driver"").
> 

Almost perfect!  Just a couple other leaks we should fix as well.

> +	ret = media_entity_pads_init(&flash->sd.entity, 0, NULL);
> +	if (ret) {
> +		dev_err(&client->dev, "error initializing media entity");
> +		goto err_free_ctrl_handler;
>  	}
>  
>  	flash->sd.entity.function = MEDIA_ENT_F_FLASH;
> @@ -881,20 +882,22 @@ static int lm3554_probe(struct i2c_client *client)
>  
>  	timer_setup(&flash->flash_off_delay, lm3554_flash_off_delay, 0);

We need to delete this timer.

>  
> -	err = lm3554_gpio_init(client);
> -	if (err) {
> +	ret = lm3554_gpio_init(client);
> +	if (ret) {
>  		dev_err(&client->dev, "gpio request/direction_output fail");
> -		goto fail2;
> +		goto err_cleanup_entity;
>  	}
>  	return atomisp_register_i2c_module(&flash->sd, NULL, LED_FLASH);

If atomisp_register_i2c_module() fails then we need to call
lm3554_gpio_uninit(client) and do other cleanup.

> -fail2:
> +
> +err_cleanup_entity:
>  	media_entity_cleanup(&flash->sd.entity);
> +err_free_ctrl_handler:
>  	v4l2_ctrl_handler_free(&flash->ctrl_handler);

regards,
dan carpenter