[PATCH v2 4/4] HID: wacom: use __free(kfree) to clean up temporary buffers
From: Benjamin Tissoires
Date: Thu Apr 16 2026 - 10:56:09 EST
This simplifies error handling and protects against memory leaks.
Signed-off-by: Benjamin Tissoires <bentiss@xxxxxxxxxx>
---
drivers/hid/wacom_sys.c | 40 +++++++++++++---------------------------
1 file changed, 13 insertions(+), 27 deletions(-)
diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c
index a32320b351e3..adb31f54e524 100644
--- a/drivers/hid/wacom_sys.c
+++ b/drivers/hid/wacom_sys.c
@@ -70,11 +70,10 @@ static void wacom_wac_queue_flush(struct hid_device *hdev,
{
while (!kfifo_is_empty(fifo)) {
int size = kfifo_peek_len(fifo);
- u8 *buf;
unsigned int count;
int err;
- buf = kzalloc(size, GFP_KERNEL);
+ u8 *buf __free(kfree) = kzalloc(size, GFP_KERNEL);
if (!buf) {
kfifo_skip(fifo);
continue;
@@ -87,7 +86,6 @@ static void wacom_wac_queue_flush(struct hid_device *hdev,
// to flush seems reasonable enough, however.
hid_warn(hdev, "%s: removed fifo entry with unexpected size\n",
__func__);
- kfree(buf);
continue;
}
err = hid_report_raw_event(hdev, HID_INPUT_REPORT, buf, size, size, false);
@@ -95,8 +93,6 @@ static void wacom_wac_queue_flush(struct hid_device *hdev,
hid_warn(hdev, "%s: unable to flush event due to error %d\n",
__func__, err);
}
-
- kfree(buf);
}
}
@@ -311,7 +307,6 @@ static void wacom_feature_mapping(struct hid_device *hdev,
struct wacom_features *features = &wacom->wacom_wac.features;
struct hid_data *hid_data = &wacom->wacom_wac.hid_data;
unsigned int equivalent_usage = wacom_equivalent_usage(usage->hid);
- u8 *data;
int ret;
u32 n;
@@ -325,10 +320,11 @@ static void wacom_feature_mapping(struct hid_device *hdev,
/* leave touch_max as is if predefined */
if (!features->touch_max) {
/* read manually */
- n = hid_report_len(field->report);
- data = hid_alloc_report_buf(field->report, GFP_KERNEL);
+ u8 *data __free(kfree) = hid_alloc_report_buf(field->report, GFP_KERNEL);
+
if (!data)
break;
+ n = hid_report_len(field->report);
data[0] = field->report->id;
ret = wacom_get_report(hdev, HID_FEATURE_REPORT,
data, n, WAC_CMD_RETRIES);
@@ -344,7 +340,6 @@ static void wacom_feature_mapping(struct hid_device *hdev,
"defaulting to %d\n",
features->touch_max);
}
- kfree(data);
}
break;
case HID_DG_INPUTMODE:
@@ -386,10 +381,11 @@ static void wacom_feature_mapping(struct hid_device *hdev,
case WACOM_HID_WD_OFFSETRIGHT:
case WACOM_HID_WD_OFFSETBOTTOM:
/* read manually */
- n = hid_report_len(field->report);
- data = hid_alloc_report_buf(field->report, GFP_KERNEL);
+ u8 *data __free(kfree) = hid_alloc_report_buf(field->report, GFP_KERNEL);
+
if (!data)
break;
+ n = hid_report_len(field->report);
data[0] = field->report->id;
ret = wacom_get_report(hdev, HID_FEATURE_REPORT,
data, n, WAC_CMD_RETRIES);
@@ -400,7 +396,6 @@ static void wacom_feature_mapping(struct hid_device *hdev,
hid_warn(hdev, "%s: could not retrieve sensor offsets\n",
__func__);
}
- kfree(data);
break;
}
}
@@ -581,7 +576,6 @@ static int wacom_hid_set_device_mode(struct hid_device *hdev)
static int wacom_set_device_mode(struct hid_device *hdev,
struct wacom_wac *wacom_wac)
{
- u8 *rep_data;
struct hid_report *r;
struct hid_report_enum *re;
u32 length;
@@ -595,7 +589,7 @@ static int wacom_set_device_mode(struct hid_device *hdev,
if (!r)
return -EINVAL;
- rep_data = hid_alloc_report_buf(r, GFP_KERNEL);
+ u8 *rep_data __free(kfree) = hid_alloc_report_buf(r, GFP_KERNEL);
if (!rep_data)
return -ENOMEM;
@@ -614,8 +608,6 @@ static int wacom_set_device_mode(struct hid_device *hdev,
rep_data[1] != wacom_wac->mode_report &&
limit++ < WAC_MSG_RETRIES);
- kfree(rep_data);
-
return error < 0 ? error : 0;
}
@@ -921,7 +913,6 @@ static int wacom_add_shared_data(struct hid_device *hdev)
static int wacom_led_control(struct wacom *wacom)
{
- unsigned char *buf;
int retval;
unsigned char report_id = WAC_CMD_LED_CONTROL;
int buf_size = 9;
@@ -940,7 +931,8 @@ static int wacom_led_control(struct wacom *wacom)
report_id = WAC_CMD_WL_INTUOSP2;
buf_size = 51;
}
- buf = kzalloc(buf_size, GFP_KERNEL);
+
+ unsigned char *buf __free(kfree) = kzalloc(buf_size, GFP_KERNEL);
if (!buf)
return -ENOMEM;
@@ -996,7 +988,6 @@ static int wacom_led_control(struct wacom *wacom)
retval = wacom_set_report(wacom->hdev, HID_FEATURE_REPORT, buf, buf_size,
WAC_CMD_RETRIES);
- kfree(buf);
return retval;
}
@@ -1004,11 +995,10 @@ static int wacom_led_control(struct wacom *wacom)
static int wacom_led_putimage(struct wacom *wacom, int button_id, u8 xfer_id,
const unsigned len, const void *img)
{
- unsigned char *buf;
int i, retval;
const unsigned chunk_len = len / 4; /* 4 chunks are needed to be sent */
- buf = kzalloc(chunk_len + 3 , GFP_KERNEL);
+ unsigned char *buf __free(kfree) = kzalloc(chunk_len + 3, GFP_KERNEL);
if (!buf)
return -ENOMEM;
@@ -1018,7 +1008,7 @@ static int wacom_led_putimage(struct wacom *wacom, int button_id, u8 xfer_id,
retval = wacom_set_report(wacom->hdev, HID_FEATURE_REPORT, buf, 2,
WAC_CMD_RETRIES);
if (retval < 0)
- goto out;
+ return retval;
buf[0] = xfer_id;
buf[1] = button_id & 0x07;
@@ -1038,8 +1028,6 @@ static int wacom_led_putimage(struct wacom *wacom, int button_id, u8 xfer_id,
wacom_set_report(wacom->hdev, HID_FEATURE_REPORT, buf, 2,
WAC_CMD_RETRIES);
-out:
- kfree(buf);
return retval;
}
@@ -1948,10 +1936,9 @@ static int wacom_remote_create_attr_group(struct wacom *wacom, __u32 serial,
static int wacom_cmd_unpair_remote(struct wacom *wacom, unsigned char selector)
{
const size_t buf_size = 2;
- unsigned char *buf;
int retval;
- buf = kzalloc(buf_size, GFP_KERNEL);
+ unsigned char *buf __free(kfree) = kzalloc(buf_size, GFP_KERNEL);
if (!buf)
return -ENOMEM;
@@ -1960,7 +1947,6 @@ static int wacom_cmd_unpair_remote(struct wacom *wacom, unsigned char selector)
retval = wacom_set_report(wacom->hdev, HID_OUTPUT_REPORT, buf,
buf_size, WAC_CMD_RETRIES);
- kfree(buf);
return retval;
}
--
2.53.0