diff options
| author | Jarod Wilson <jarod@redhat.com> | 2010-07-29 21:34:52 (GMT) |
|---|---|---|
| committer | Mauro Carvalho Chehab <mchehab@redhat.com> | 2010-08-09 02:42:57 (GMT) |
| commit | 7a9fcb41b9370a32bb65bece9afc83701ab2d2b6 (patch) | |
| tree | 3b43d53f7c05c65da4b04a82d8cb35c963b9e9e7 /drivers | |
| parent | da48db669f50d47c208da3648dca7cac7ea6dcca (diff) | |
| download | linux-fsl-qoriq-7a9fcb41b9370a32bb65bece9afc83701ab2d2b6.tar.xz | |
V4L/DVB: IR/mceusb: remove bad ir_input_dev use
The ir_input_dev gets filled in by __ir_input_register, the one
allocated in mceusb_init_input_dev was being overwritten by the correct
one shortly after it was initialized (ultimately resulting in a memory
leak). This bug was inherited from imon.c, and was pointed out to me by
Maxim Levitsky.
v2: fix incorrect dev arg to dev_dbg
Signed-off-by: Jarod Wilson <jarod@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/media/IR/mceusb.c | 15 |
1 files changed, 1 insertions, 14 deletions
diff --git a/drivers/media/IR/mceusb.c b/drivers/media/IR/mceusb.c index 78bf7f7..65b0738 100644 --- a/drivers/media/IR/mceusb.c +++ b/drivers/media/IR/mceusb.c @@ -228,7 +228,6 @@ static struct usb_device_id std_tx_mask_list[] = { /* data structure for each usb transceiver */ struct mceusb_dev { /* ir-core bits */ - struct ir_input_dev *irdev; struct ir_dev_props *props; struct ir_raw_event rawir; @@ -739,7 +738,7 @@ static void mceusb_dev_recv(struct urb *urb, struct pt_regs *regs) if (ir->send_flags == RECV_FLAG_IN_PROGRESS) { ir->send_flags = SEND_FLAG_COMPLETE; - dev_dbg(&ir->irdev->dev, "setup answer received %d bytes\n", + dev_dbg(ir->dev, "setup answer received %d bytes\n", buf_len); } @@ -861,7 +860,6 @@ static struct input_dev *mceusb_init_input_dev(struct mceusb_dev *ir) { struct input_dev *idev; struct ir_dev_props *props; - struct ir_input_dev *irdev; struct device *dev = ir->dev; int ret = -ENODEV; @@ -878,12 +876,6 @@ static struct input_dev *mceusb_init_input_dev(struct mceusb_dev *ir) goto props_alloc_failed; } - irdev = kzalloc(sizeof(struct ir_input_dev), GFP_KERNEL); - if (!irdev) { - dev_err(dev, "remote ir input dev allocation failed\n"); - goto ir_dev_alloc_failed; - } - snprintf(ir->name, sizeof(ir->name), "Media Center Ed. eHome " "Infrared Remote Transceiver (%04x:%04x)", le16_to_cpu(ir->usbdev->descriptor.idVendor), @@ -902,9 +894,6 @@ static struct input_dev *mceusb_init_input_dev(struct mceusb_dev *ir) props->tx_ir = mceusb_tx_ir; ir->props = props; - ir->irdev = irdev; - - input_set_drvdata(idev, irdev); ret = ir_input_register(idev, RC_MAP_RC6_MCE, props, DRIVER_NAME); if (ret < 0) { @@ -915,8 +904,6 @@ static struct input_dev *mceusb_init_input_dev(struct mceusb_dev *ir) return idev; irdev_failed: - kfree(irdev); -ir_dev_alloc_failed: kfree(props); props_alloc_failed: input_free_device(idev); |