On Thu, Oct 13, 2016 at 06:24:46PM +0200, SF Markus Elfring wrote: > From: Markus Elfring <elfr...@users.sourceforge.net> > Date: Thu, 13 Oct 2016 10:50:24 +0200 > > The kfree() function was called in one case by the > redrat3_transmit_ir() function during error handling > even if the passed variable contained a null pointer. > > * Adjust jump targets according to the Linux coding style convention. > > * Move the resetting for the data structure member "transmitting" > at the end. > > * Delete initialisations for the variables "irdata" and "sample_lens" > at the beginning which became unnecessary with this refactoring. > > Signed-off-by: Markus Elfring <elfr...@users.sourceforge.net> > --- > drivers/media/rc/redrat3.c | 18 ++++++++---------- > 1 file changed, 8 insertions(+), 10 deletions(-) > > diff --git a/drivers/media/rc/redrat3.c b/drivers/media/rc/redrat3.c > index 7ae2ced..71e901d 100644 > --- a/drivers/media/rc/redrat3.c > +++ b/drivers/media/rc/redrat3.c > @@ -723,10 +723,10 @@ static int redrat3_transmit_ir(struct rc_dev *rcdev, > unsigned *txbuf, > { > struct redrat3_dev *rr3 = rcdev->priv; > struct device *dev = rr3->dev; > - struct redrat3_irdata *irdata = NULL; > + struct redrat3_irdata *irdata; > int ret, ret_len; > int lencheck, cur_sample_len, pipe; > - int *sample_lens = NULL; > + int *sample_lens; > u8 curlencheck; > unsigned i, sendbuf_len; > > @@ -747,7 +747,7 @@ static int redrat3_transmit_ir(struct rc_dev *rcdev, > unsigned *txbuf, > irdata = kzalloc(sizeof(*irdata), GFP_KERNEL); > if (!irdata) { > ret = -ENOMEM; > - goto out; > + goto free_sample; > } > > /* rr3 will disable rc detector on transmit */ > @@ -776,7 +776,7 @@ static int redrat3_transmit_ir(struct rc_dev *rcdev, > unsigned *txbuf, > curlencheck++; > } else { > ret = -EINVAL; > - goto out; > + goto reset_member; > } > } > irdata->sigdata[i] = lencheck; > @@ -811,14 +811,12 @@ static int redrat3_transmit_ir(struct rc_dev *rcdev, > unsigned *txbuf, > dev_err(dev, "Error: control msg send failed, rc %d\n", ret); > else > ret = count; > - > -out: > - kfree(irdata); > - kfree(sample_lens); > - > +reset_member: > rr3->transmitting = false; > /* rr3 re-enables rc detector because it was enabled before */ > - > + kfree(irdata); > +free_sample: > + kfree(sample_lens);
In this error path, rr3->transmitting is not set to false so now the driver will never allow you transmit again. Also this patch does not apply against latest. Sean > return ret; > } > > -- > 2.10.1 > > -- > To unsubscribe from this list: send the line "unsubscribe linux-media" in > the body of a message to majord...@vger.kernel.org > More majordomo info at http://vger.kernel.org/majordomo-info.html -- To unsubscribe from this list: send the line "unsubscribe linux-media" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html