cx231xx: fix double free and leaks on failure path in cx231xx_usb_probe()
authorAlexey Khoroshilov <khoroshilov@ispras.ru>
Mon, 7 Oct 2013 21:06:04 +0000 (18:06 -0300)
committerBen Hutchings <ben@decadent.org.uk>
Sat, 26 Aug 2017 01:13:59 +0000 (02:13 +0100)
commit6e9ffe1aa862b5682116dd398b09e609f067ab36
tree7ee3e232b61d09039696b9416f926e416e4e5b39
parentcc63d977beaa8a317f99ac6d7c843965007bd2c1
cx231xx: fix double free and leaks on failure path in cx231xx_usb_probe()

commit 256d013a9bcc9a39b2e4b34ab19219bd054cf270 upstream.

There are numerous issues in error handling code of cx231xx initialization.
Double free (when cx231xx_init_dev() calls kfree(dev) via cx231xx_release_resources()
and then cx231xx_usb_probe() does the same) and memory leaks
(e.g. usb_get_dev() before (ifnum != 1) check in cx231xx_usb_probe())
are just a few of them.
The patch fixes the issues in cx231xx_usb_probe() and cx231xx_init_dev()
by moving usb_get_dev(interface_to_usbdev(interface)) below in code and
implementing proper error handling.
Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
[bwh: Backported to 3.2:
 - Keep using &= rather than clear_bit()
 - Adjust filename, context
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
drivers/media/video/cx231xx/cx231xx-cards.c