V4L/DVB: IR/mceusb: remove bad ir_input_dev use
The ir_input_dev gets filled in by __ir_input_register, the one allocated in mceusb_init_input_dev was being overwritten by the correct one shortly after it was initialized (ultimately resulting in a memory leak). This bug was inherited from imon.c, and was pointed out to me by Maxim Levitsky. v2: fix incorrect dev arg to dev_dbg Signed-off-by: Jarod Wilson <jarod@redhat.com> Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
This commit is contained in:
Родитель
da48db669f
Коммит
7a9fcb41b9
|
@ -228,7 +228,6 @@ static struct usb_device_id std_tx_mask_list[] = {
|
||||||
/* data structure for each usb transceiver */
|
/* data structure for each usb transceiver */
|
||||||
struct mceusb_dev {
|
struct mceusb_dev {
|
||||||
/* ir-core bits */
|
/* ir-core bits */
|
||||||
struct ir_input_dev *irdev;
|
|
||||||
struct ir_dev_props *props;
|
struct ir_dev_props *props;
|
||||||
struct ir_raw_event rawir;
|
struct ir_raw_event rawir;
|
||||||
|
|
||||||
|
@ -739,7 +738,7 @@ static void mceusb_dev_recv(struct urb *urb, struct pt_regs *regs)
|
||||||
|
|
||||||
if (ir->send_flags == RECV_FLAG_IN_PROGRESS) {
|
if (ir->send_flags == RECV_FLAG_IN_PROGRESS) {
|
||||||
ir->send_flags = SEND_FLAG_COMPLETE;
|
ir->send_flags = SEND_FLAG_COMPLETE;
|
||||||
dev_dbg(&ir->irdev->dev, "setup answer received %d bytes\n",
|
dev_dbg(ir->dev, "setup answer received %d bytes\n",
|
||||||
buf_len);
|
buf_len);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -861,7 +860,6 @@ static struct input_dev *mceusb_init_input_dev(struct mceusb_dev *ir)
|
||||||
{
|
{
|
||||||
struct input_dev *idev;
|
struct input_dev *idev;
|
||||||
struct ir_dev_props *props;
|
struct ir_dev_props *props;
|
||||||
struct ir_input_dev *irdev;
|
|
||||||
struct device *dev = ir->dev;
|
struct device *dev = ir->dev;
|
||||||
int ret = -ENODEV;
|
int ret = -ENODEV;
|
||||||
|
|
||||||
|
@ -878,12 +876,6 @@ static struct input_dev *mceusb_init_input_dev(struct mceusb_dev *ir)
|
||||||
goto props_alloc_failed;
|
goto props_alloc_failed;
|
||||||
}
|
}
|
||||||
|
|
||||||
irdev = kzalloc(sizeof(struct ir_input_dev), GFP_KERNEL);
|
|
||||||
if (!irdev) {
|
|
||||||
dev_err(dev, "remote ir input dev allocation failed\n");
|
|
||||||
goto ir_dev_alloc_failed;
|
|
||||||
}
|
|
||||||
|
|
||||||
snprintf(ir->name, sizeof(ir->name), "Media Center Ed. eHome "
|
snprintf(ir->name, sizeof(ir->name), "Media Center Ed. eHome "
|
||||||
"Infrared Remote Transceiver (%04x:%04x)",
|
"Infrared Remote Transceiver (%04x:%04x)",
|
||||||
le16_to_cpu(ir->usbdev->descriptor.idVendor),
|
le16_to_cpu(ir->usbdev->descriptor.idVendor),
|
||||||
|
@ -902,9 +894,6 @@ static struct input_dev *mceusb_init_input_dev(struct mceusb_dev *ir)
|
||||||
props->tx_ir = mceusb_tx_ir;
|
props->tx_ir = mceusb_tx_ir;
|
||||||
|
|
||||||
ir->props = props;
|
ir->props = props;
|
||||||
ir->irdev = irdev;
|
|
||||||
|
|
||||||
input_set_drvdata(idev, irdev);
|
|
||||||
|
|
||||||
ret = ir_input_register(idev, RC_MAP_RC6_MCE, props, DRIVER_NAME);
|
ret = ir_input_register(idev, RC_MAP_RC6_MCE, props, DRIVER_NAME);
|
||||||
if (ret < 0) {
|
if (ret < 0) {
|
||||||
|
@ -915,8 +904,6 @@ static struct input_dev *mceusb_init_input_dev(struct mceusb_dev *ir)
|
||||||
return idev;
|
return idev;
|
||||||
|
|
||||||
irdev_failed:
|
irdev_failed:
|
||||||
kfree(irdev);
|
|
||||||
ir_dev_alloc_failed:
|
|
||||||
kfree(props);
|
kfree(props);
|
||||||
props_alloc_failed:
|
props_alloc_failed:
|
||||||
input_free_device(idev);
|
input_free_device(idev);
|
||||||
|
|
Загрузка…
Ссылка в новой задаче