[media] staging/lirc: fix mem leaks and ptr err usage

When the lirc drivers were converted over to using memdup_user, I
mistakenly also removed corresponding calls to kfree. Add those back. I
also screwed up on the allocation error check in lirc_serial, using if
(PTR_ERR()) instead of if (IS_ERR()), which broke transmit.

Reported-by: Jiri Fojtasek <jiri.fojtasek@hlohovec.net>
Signed-off-by: Jarod Wilson <jarod@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>

diff --git a/drivers/staging/lirc/lirc_imon.c b/drivers/staging/lirc/lirc_imon.c
index 0da6b9518af9ea4e068051ca24706e97aa917faa..235cab0eb0877483267fac5dbdf6c75364a5f59e 100644 (file)
--- a/drivers/staging/lirc/lirc_imon.c
+++ b/drivers/staging/lirc/lirc_imon.c
@@ -447,6 +447,7 @@ static ssize_t vfd_write(struct file *file, const char *buf,
 
 exit:
        mutex_unlock(&context->ctx_lock);
+       kfree(data_buf);
 
        return (!retval) ? n_bytes : retval;
 }

diff --git a/drivers/staging/lirc/lirc_it87.c b/drivers/staging/lirc/lirc_it87.c
index 929ae579546773c5a6f1cd34fc58f908985df1dc..5938616f3e8fc957f120c7b6888740a3e554a9ef 100644 (file)
--- a/drivers/staging/lirc/lirc_it87.c
+++ b/drivers/staging/lirc/lirc_it87.c
@@ -232,6 +232,7 @@ static ssize_t lirc_write(struct file *file, const char *buf,
                i++;
        }
        terminate_send(tx_buf[i - 1]);
+       kfree(tx_buf);
        return n;
 }
 

diff --git a/drivers/staging/lirc/lirc_parallel.c b/drivers/staging/lirc/lirc_parallel.c
index dfd2c447e67d38aca01dfc833ee23ab6f1e77486..3a9c09881b2b7064e4d3109e5b4d05463a93d123 100644 (file)
--- a/drivers/staging/lirc/lirc_parallel.c
+++ b/drivers/staging/lirc/lirc_parallel.c
@@ -376,6 +376,7 @@ static ssize_t lirc_write(struct file *filep, const char *buf, size_t n,
        unsigned long flags;
        int counttimer;
        int *wbuf;
+       ssize_t ret;
 
        if (!is_claimed)
                return -EBUSY;
@@ -393,8 +394,10 @@ static ssize_t lirc_write(struct file *filep, const char *buf, size_t n,
        if (timer == 0) {
                /* try again if device is ready */
                timer = init_lirc_timer();
-               if (timer == 0)
-                       return -EIO;
+               if (timer == 0) {
+                       ret = -EIO;
+                       goto out;
+               }
        }
 
        /* adjust values from usecs */
@@ -420,7 +423,8 @@ static ssize_t lirc_write(struct file *filep, const char *buf, size_t n,
                        if (check_pselecd && (in(1) & LP_PSELECD)) {
                                lirc_off();
                                local_irq_restore(flags);
-                               return -EIO;
+                               ret = -EIO;
+                               goto out;
                        }
                } while (counttimer < wbuf[i]);
                i++;
@@ -436,7 +440,8 @@ static ssize_t lirc_write(struct file *filep, const char *buf, size_t n,
                        level = newlevel;
                        if (check_pselecd && (in(1) & LP_PSELECD)) {
                                local_irq_restore(flags);
-                               return -EIO;
+                               ret = -EIO;
+                               goto out;
                        }
                } while (counttimer < wbuf[i]);
                i++;
@@ -445,7 +450,11 @@ static ssize_t lirc_write(struct file *filep, const char *buf, size_t n,
 #else
        /* place code that handles write without external timer here */
 #endif
-       return n;
+       ret = n;
+out:
+       kfree(wbuf);
+
+       return ret;
 }
 
 static unsigned int lirc_poll(struct file *file, poll_table *wait)

diff --git a/drivers/staging/lirc/lirc_sasem.c b/drivers/staging/lirc/lirc_sasem.c
index 998485ebdbceb136c764449b3667872b32cc5090..925eabe14854d93cc0267110da2ba646758f0aaf 100644 (file)
--- a/drivers/staging/lirc/lirc_sasem.c
+++ b/drivers/staging/lirc/lirc_sasem.c
@@ -448,6 +448,7 @@ static ssize_t vfd_write(struct file *file, const char *buf,
 exit:
 
        mutex_unlock(&context->ctx_lock);
+       kfree(data_buf);
 
        return (!retval) ? n_bytes : retval;
 }

diff --git a/drivers/staging/lirc/lirc_serial.c b/drivers/staging/lirc/lirc_serial.c
index 9bcf149c4260ad3a8020caccc98801fff40664de..1c3099b388e0acefd601621dbe05a9c6b78451b7 100644 (file)
--- a/drivers/staging/lirc/lirc_serial.c
+++ b/drivers/staging/lirc/lirc_serial.c
@@ -966,7 +966,7 @@ static ssize_t lirc_write(struct file *file, const char *buf,
        if (n % sizeof(int) || count % 2 == 0)
                return -EINVAL;
        wbuf = memdup_user(buf, n);
-       if (PTR_ERR(wbuf))
+       if (IS_ERR(wbuf))
                return PTR_ERR(wbuf);
        spin_lock_irqsave(&hardware[type].lock, flags);
        if (type == LIRC_IRDEO) {
@@ -981,6 +981,7 @@ static ssize_t lirc_write(struct file *file, const char *buf,
        }
        off();
        spin_unlock_irqrestore(&hardware[type].lock, flags);
+       kfree(wbuf);
        return n;
 }
 

diff --git a/drivers/staging/lirc/lirc_sir.c b/drivers/staging/lirc/lirc_sir.c
index c553ab6262386ad4b68916f928ee25c770f3fbf2..76be7b8c620968218822c3216204e14ffdc2250b 100644 (file)
--- a/drivers/staging/lirc/lirc_sir.c
+++ b/drivers/staging/lirc/lirc_sir.c
@@ -330,6 +330,7 @@ static ssize_t lirc_write(struct file *file, const char *buf, size_t n,
        /* enable receiver */
        Ser2UTCR3 = UTCR3_RXE|UTCR3_RIE;
 #endif
+       kfree(tx_buf);
        return count;
 }