[PATCH] media: dm1105: fix rc_dev leak on probe error paths

[PATCH] media: dm1105: fix rc_dev leak on probe error paths

[Chen Changcheng]

dm1105_ir_init() registers an rc_dev that must be cleaned up by
dm1105_ir_exit().  However, in dm1105_probe() the return value of
dm1105_ir_init() is ignored, and neither the workqueue nor the
request_irq error path calls dm1105_ir_exit().  If IR initialization
succeeds but a later step (create_singlethread_workqueue or
request_irq) fails, the registered rc_dev is leaked.

Signed-off-by: Chen Changcheng <chenchangcheng@kylinos.cn>
---
 drivers/media/pci/dm1105/dm1105.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/media/pci/dm1105/dm1105.c b/drivers/media/pci/dm1105/dm1105.c
index ae4544042a74..9d49e95c8182 100644
--- a/drivers/media/pci/dm1105/dm1105.c
+++ b/drivers/media/pci/dm1105/dm1105.c
@@ -1125,14 +1125,16 @@ static int dm1105_probe(struct pci_dev *pdev,
 	if (ret < 0)
 		goto err_dvb_net;
 
-	dm1105_ir_init(dev);
+	ret = dm1105_ir_init(dev);
+	if (ret)
+		goto err_dvb_net;
 
 	INIT_WORK(&dev->work, dm1105_dmx_buffer);
 	sprintf(dev->wqn, "%s/%d", dvb_adapter->name, dvb_adapter->num);
 	dev->wq = create_singlethread_workqueue(dev->wqn);
 	if (!dev->wq) {
 		ret = -ENOMEM;
-		goto err_dvb_net;
+		goto err_dm1105_ir_exit;
 	}
 
 	ret = request_irq(pdev->irq, dm1105_irq, IRQF_SHARED,
@@ -1144,6 +1146,8 @@ static int dm1105_probe(struct pci_dev *pdev,
 
 err_workqueue:
 	destroy_workqueue(dev->wq);
+err_dm1105_ir_exit:
+	dm1105_ir_exit(dev);
 err_dvb_net:
 	dvb_net_release(&dev->dvbnet);
 err_disconnect_frontend:

base-commit: c03c1a14507dfaf8b856c2608f9ac216021fc222
-- 
2.25.1

Re: [PATCH] media: dm1105: fix rc_dev leak on probe error paths

[Markus Elfring]

> dm1105_ir_init() registers an rc_dev that must be cleaned up by
> dm1105_ir_exit().  However, in dm1105_probe() the return value of
> dm1105_ir_init() is ignored, and neither the workqueue nor the
> request_irq error path calls dm1105_ir_exit().  If IR initialization
> succeeds but a later step (create_singlethread_workqueue or
> request_irq) fails, the registered rc_dev is leaked.

How do you think about to add any tags (like “Fixes” and “Cc”) accordingly?

See also:
* https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/submitting-patches.rst?h=v7.3#n145
* https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/stable-kernel-rules.rst?h=v7.3#n34


Regards,
Markus