From: Alexey Khoroshilov Date: Mon, 7 Oct 2013 21:06:04 +0000 (-0300) Subject: cx231xx: fix double free and leaks on failure path in cx231xx_usb_probe() X-Git-Tag: v3.2.92~41 X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=6e9ffe1aa862b5682116dd398b09e609f067ab36;p=pandora-kernel.git cx231xx: fix double free and leaks on failure path in cx231xx_usb_probe() commit 256d013a9bcc9a39b2e4b34ab19219bd054cf270 upstream. There are numerous issues in error handling code of cx231xx initialization. Double free (when cx231xx_init_dev() calls kfree(dev) via cx231xx_release_resources() and then cx231xx_usb_probe() does the same) and memory leaks (e.g. usb_get_dev() before (ifnum != 1) check in cx231xx_usb_probe()) are just a few of them. The patch fixes the issues in cx231xx_usb_probe() and cx231xx_init_dev() by moving usb_get_dev(interface_to_usbdev(interface)) below in code and implementing proper error handling. Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Alexey Khoroshilov Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab [bwh: Backported to 3.2: - Keep using &= rather than clear_bit() - Adjust filename, context Signed-off-by: Ben Hutchings --- Reading git-diff-tree failed