linux-kernel - [PATCH] input: raspberrypi-ts: Fix refcount leak in rpi_ts

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20221220115246.1522054-1-linmq006@gmail.com>
Date:   Tue, 20 Dec 2022 15:52:43 +0400
From:   Miaoqian Lin <linmq006@...il.com>
To:     Dmitry Torokhov <dmitry.torokhov@...il.com>,
        Florian Fainelli <f.fainelli@...il.com>,
        Broadcom internal kernel review list 
        <bcm-kernel-feedback-list@...adcom.com>,
        Miaoqian Lin <linmq006@...il.com>,
        Rob Herring <robh@...nel.org>,
        Nicolas Saenz Julienne <nsaenz@...nel.org>,
        Eric Anholt <eric@...olt.net>, linux-input@...r.kernel.org,
        linux-rpi-kernel@...ts.infradead.org,
        linux-arm-kernel@...ts.infradead.org, linux-kernel@...r.kernel.org
Subject: [PATCH] input: raspberrypi-ts: Fix refcount leak in rpi_ts_probe

rpi_firmware_get() take reference, we need to release it in error paths
as well. Add missing rpi_firmware_put() in the error handling to fix it.

Fixes: 0b9f28fed3f7 ("Input: add official Raspberry Pi's touchscreen driver")
Fixes: 3b8ddff780b7 ("input: raspberrypi-ts: Release firmware handle when not needed")
Signed-off-by: Miaoqian Lin <linmq006@...il.com>
---
 drivers/input/touchscreen/raspberrypi-ts.c | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/drivers/input/touchscreen/raspberrypi-ts.c b/drivers/input/touchscreen/raspberrypi-ts.c
index 5000f5fd9ec3..114237c76378 100644
--- a/drivers/input/touchscreen/raspberrypi-ts.c
+++ b/drivers/input/touchscreen/raspberrypi-ts.c
@@ -140,21 +140,24 @@ static int rpi_ts_probe(struct platform_device *pdev)
 		return -EPROBE_DEFER;
 
 	ts = devm_kzalloc(dev, sizeof(*ts), GFP_KERNEL);
-	if (!ts)
-		return -ENOMEM;
+	if (!ts) {
+		error = -ENOMEM;
+		goto err_put_fw;
+	}
 	ts->pdev = pdev;
 
 	ts->fw_regs_va = dma_alloc_coherent(dev, PAGE_SIZE, &ts->fw_regs_phys,
 					    GFP_KERNEL);
 	if (!ts->fw_regs_va) {
 		dev_err(dev, "failed to dma_alloc_coherent\n");
-		return -ENOMEM;
+		error = -ENOMEM;
+		goto err_put_fw;
 	}
 
 	error = devm_add_action_or_reset(dev, rpi_ts_dma_cleanup, ts);
 	if (error) {
 		dev_err(dev, "failed to devm_add_action_or_reset, %d\n", error);
-		return error;
+		goto err_put_fw;
 	}
 
 	touchbuf = (u32)ts->fw_regs_phys;
@@ -206,6 +209,10 @@ static int rpi_ts_probe(struct platform_device *pdev)
 	}
 
 	return 0;
+
+err_put_fw:
+	rpi_firmware_put(fw);
+	return error;
 }
 
 static const struct of_device_id rpi_ts_match[] = {
-- 
2.25.1