提交 7a9fcb41 编写于 作者: J Jarod Wilson 提交者: Mauro Carvalho Chehab

V4L/DVB: IR/mceusb: remove bad ir_input_dev use

The ir_input_dev gets filled in by __ir_input_register, the one
allocated in mceusb_init_input_dev was being overwritten by the correct
one shortly after it was initialized (ultimately resulting in a memory
leak). This bug was inherited from imon.c, and was pointed out to me by
Maxim Levitsky.

v2: fix incorrect dev arg to dev_dbg
Signed-off-by: NJarod Wilson <jarod@redhat.com>
Signed-off-by: NMauro Carvalho Chehab <mchehab@redhat.com>
上级 da48db66
...@@ -228,7 +228,6 @@ static struct usb_device_id std_tx_mask_list[] = { ...@@ -228,7 +228,6 @@ static struct usb_device_id std_tx_mask_list[] = {
/* data structure for each usb transceiver */ /* data structure for each usb transceiver */
struct mceusb_dev { struct mceusb_dev {
/* ir-core bits */ /* ir-core bits */
struct ir_input_dev *irdev;
struct ir_dev_props *props; struct ir_dev_props *props;
struct ir_raw_event rawir; struct ir_raw_event rawir;
...@@ -739,7 +738,7 @@ static void mceusb_dev_recv(struct urb *urb, struct pt_regs *regs) ...@@ -739,7 +738,7 @@ static void mceusb_dev_recv(struct urb *urb, struct pt_regs *regs)
if (ir->send_flags == RECV_FLAG_IN_PROGRESS) { if (ir->send_flags == RECV_FLAG_IN_PROGRESS) {
ir->send_flags = SEND_FLAG_COMPLETE; ir->send_flags = SEND_FLAG_COMPLETE;
dev_dbg(&ir->irdev->dev, "setup answer received %d bytes\n", dev_dbg(ir->dev, "setup answer received %d bytes\n",
buf_len); buf_len);
} }
...@@ -861,7 +860,6 @@ static struct input_dev *mceusb_init_input_dev(struct mceusb_dev *ir) ...@@ -861,7 +860,6 @@ static struct input_dev *mceusb_init_input_dev(struct mceusb_dev *ir)
{ {
struct input_dev *idev; struct input_dev *idev;
struct ir_dev_props *props; struct ir_dev_props *props;
struct ir_input_dev *irdev;
struct device *dev = ir->dev; struct device *dev = ir->dev;
int ret = -ENODEV; int ret = -ENODEV;
...@@ -878,12 +876,6 @@ static struct input_dev *mceusb_init_input_dev(struct mceusb_dev *ir) ...@@ -878,12 +876,6 @@ static struct input_dev *mceusb_init_input_dev(struct mceusb_dev *ir)
goto props_alloc_failed; goto props_alloc_failed;
} }
irdev = kzalloc(sizeof(struct ir_input_dev), GFP_KERNEL);
if (!irdev) {
dev_err(dev, "remote ir input dev allocation failed\n");
goto ir_dev_alloc_failed;
}
snprintf(ir->name, sizeof(ir->name), "Media Center Ed. eHome " snprintf(ir->name, sizeof(ir->name), "Media Center Ed. eHome "
"Infrared Remote Transceiver (%04x:%04x)", "Infrared Remote Transceiver (%04x:%04x)",
le16_to_cpu(ir->usbdev->descriptor.idVendor), le16_to_cpu(ir->usbdev->descriptor.idVendor),
...@@ -902,9 +894,6 @@ static struct input_dev *mceusb_init_input_dev(struct mceusb_dev *ir) ...@@ -902,9 +894,6 @@ static struct input_dev *mceusb_init_input_dev(struct mceusb_dev *ir)
props->tx_ir = mceusb_tx_ir; props->tx_ir = mceusb_tx_ir;
ir->props = props; ir->props = props;
ir->irdev = irdev;
input_set_drvdata(idev, irdev);
ret = ir_input_register(idev, RC_MAP_RC6_MCE, props, DRIVER_NAME); ret = ir_input_register(idev, RC_MAP_RC6_MCE, props, DRIVER_NAME);
if (ret < 0) { if (ret < 0) {
...@@ -915,8 +904,6 @@ static struct input_dev *mceusb_init_input_dev(struct mceusb_dev *ir) ...@@ -915,8 +904,6 @@ static struct input_dev *mceusb_init_input_dev(struct mceusb_dev *ir)
return idev; return idev;
irdev_failed: irdev_failed:
kfree(irdev);
ir_dev_alloc_failed:
kfree(props); kfree(props);
props_alloc_failed: props_alloc_failed:
input_free_device(idev); input_free_device(idev);
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册