Re: [PATCH 04/18] [media] RedRat3: One function call less in redrat3_transmit_ir() after error detection

[Sean Young]

On Thu, Oct 13, 2016 at 06:24:46PM +0200, SF Markus Elfring wrote:
> From: Markus Elfring <elfring@xxxxxxxxxxxxxxxxxxxxx>
> Date: Thu, 13 Oct 2016 10:50:24 +0200
> 
> The kfree() function was called in one case by the
> redrat3_transmit_ir() function during error handling
> even if the passed variable contained a null pointer.
> 
> * Adjust jump targets according to the Linux coding style convention.
> 
> * Move the resetting for the data structure member "transmitting"
>   at the end.
> 
> * Delete initialisations for the variables "irdata" and "sample_lens"
>   at the beginning which became unnecessary with this refactoring.
> 
> Signed-off-by: Markus Elfring <elfring@xxxxxxxxxxxxxxxxxxxxx>
> ---
>  drivers/media/rc/redrat3.c | 18 ++++++++----------
>  1 file changed, 8 insertions(+), 10 deletions(-)
> 
> diff --git a/drivers/media/rc/redrat3.c b/drivers/media/rc/redrat3.c
> index 7ae2ced..71e901d 100644
> --- a/drivers/media/rc/redrat3.c
> +++ b/drivers/media/rc/redrat3.c
> @@ -723,10 +723,10 @@ static int redrat3_transmit_ir(struct rc_dev *rcdev, unsigned *txbuf,
>  {
>  	struct redrat3_dev *rr3 = rcdev->priv;
>  	struct device *dev = rr3->dev;
> -	struct redrat3_irdata *irdata = NULL;
> +	struct redrat3_irdata *irdata;
>  	int ret, ret_len;
>  	int lencheck, cur_sample_len, pipe;
> -	int *sample_lens = NULL;
> +	int *sample_lens;
>  	u8 curlencheck;
>  	unsigned i, sendbuf_len;
>  
> @@ -747,7 +747,7 @@ static int redrat3_transmit_ir(struct rc_dev *rcdev, unsigned *txbuf,
>  	irdata = kzalloc(sizeof(*irdata), GFP_KERNEL);
>  	if (!irdata) {
>  		ret = -ENOMEM;
> -		goto out;
> +		goto free_sample;
>  	}
>  
>  	/* rr3 will disable rc detector on transmit */
> @@ -776,7 +776,7 @@ static int redrat3_transmit_ir(struct rc_dev *rcdev, unsigned *txbuf,
>  				curlencheck++;
>  			} else {
>  				ret = -EINVAL;
> -				goto out;
> +				goto reset_member;
>  			}
>  		}
>  		irdata->sigdata[i] = lencheck;
> @@ -811,14 +811,12 @@ static int redrat3_transmit_ir(struct rc_dev *rcdev, unsigned *txbuf,
>  		dev_err(dev, "Error: control msg send failed, rc %d\n", ret);
>  	else
>  		ret = count;
> -
> -out:
> -	kfree(irdata);
> -	kfree(sample_lens);
> -
> +reset_member:
>  	rr3->transmitting = false;
>  	/* rr3 re-enables rc detector because it was enabled before */
> -
> +	kfree(irdata);
> +free_sample:
> +	kfree(sample_lens);

In this error path, rr3->transmitting is not set to false so now the driver
will never allow you transmit again.

Also this patch does not apply against latest.

Sean

>  	return ret;
>  }
>  
> -- 
> 2.10.1
> 
> --
> To unsubscribe from this list: send the line "unsubscribe linux-media" in
> the body of a message to majordomo@xxxxxxxxxxxxxxx
> More majordomo info at  http://vger.kernel.org/majordomo-info.html