| From 70c9774e180d151abaab358108e3510a8e615215 Mon Sep 17 00:00:00 2001 |
| From: Yang Yingliang <yangyingliang@huawei.com> |
| Date: Mon, 25 Oct 2021 20:41:59 +0800 |
| Subject: iio: accel: kxcjk-1013: Fix possible memory leak in probe and remove |
| |
| From: Yang Yingliang <yangyingliang@huawei.com> |
| |
| commit 70c9774e180d151abaab358108e3510a8e615215 upstream. |
| |
| When ACPI type is ACPI_SMO8500, the data->dready_trig will not be set, the |
| memory allocated by iio_triggered_buffer_setup() will not be freed, and cause |
| memory leak as follows: |
| |
| unreferenced object 0xffff888009551400 (size 512): |
| comm "i2c-SMO8500-125", pid 911, jiffies 4294911787 (age 83.852s) |
| hex dump (first 32 bytes): |
| 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ |
| 00 00 00 00 00 00 00 00 20 e2 e5 c0 ff ff ff ff ........ ....... |
| backtrace: |
| [<0000000041ce75ee>] kmem_cache_alloc_trace+0x16d/0x360 |
| [<000000000aeb17b0>] iio_kfifo_allocate+0x41/0x130 [kfifo_buf] |
| [<000000004b40c1f5>] iio_triggered_buffer_setup_ext+0x2c/0x210 [industrialio_triggered_buffer] |
| [<000000004375b15f>] kxcjk1013_probe+0x10c3/0x1d81 [kxcjk_1013] |
| |
| Fix it by remove data->dready_trig condition in probe and remove. |
| |
| Reported-by: Hulk Robot <hulkci@huawei.com> |
| Fixes: a25691c1f967 ("iio: accel: kxcjk1013: allow using an external trigger") |
| Signed-off-by: Yang Yingliang <yangyingliang@huawei.com> |
| Cc: <Stable@vger.kernel.org> |
| Reviewed-by: Hans de Goede <hdegoede@redhat.com> |
| Link: https://lore.kernel.org/r/20211025124159.2700301-1-yangyingliang@huawei.com |
| Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| drivers/iio/accel/kxcjk-1013.c | 5 ++--- |
| 1 file changed, 2 insertions(+), 3 deletions(-) |
| |
| --- a/drivers/iio/accel/kxcjk-1013.c |
| +++ b/drivers/iio/accel/kxcjk-1013.c |
| @@ -1284,8 +1284,7 @@ static int kxcjk1013_probe(struct i2c_cl |
| err_iio_unregister: |
| iio_device_unregister(indio_dev); |
| err_buffer_cleanup: |
| - if (data->dready_trig) |
| - iio_triggered_buffer_cleanup(indio_dev); |
| + iio_triggered_buffer_cleanup(indio_dev); |
| err_trigger_unregister: |
| if (data->dready_trig) |
| iio_trigger_unregister(data->dready_trig); |
| @@ -1308,8 +1307,8 @@ static int kxcjk1013_remove(struct i2c_c |
| |
| iio_device_unregister(indio_dev); |
| |
| + iio_triggered_buffer_cleanup(indio_dev); |
| if (data->dready_trig) { |
| - iio_triggered_buffer_cleanup(indio_dev); |
| iio_trigger_unregister(data->dready_trig); |
| iio_trigger_unregister(data->motion_trig); |
| } |