Fix memory leak in imon and mceusb drivers

Signed-off-by: Jarod Wilson <jarod@redhat.com>

2 files changed, 146 insertions, 1 deletions

diff --git a/kernel.spec b/kernel.spec
index 8bafd13ed..2e0510df8 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -48,7 +48,7 @@ Summary: The Linux kernel
 # reset this by hand to 1 (or to 0 and then use rpmdev-bumpspec).
 # scripts/rebase.sh should be made to do that for you, actually.
 #
-%global baserelease 57
+%global baserelease 58
 %global fedora_build %{baserelease}
 
 # base_sublevel is the kernel version we're starting with and patching
@@ -673,6 +673,7 @@ Patch2902: linux-2.6-v4l-dvb-uvcvideo-update.patch
 Patch2910: linux-2.6-v4l-dvb-add-lgdt3304-support.patch
 Patch2911: linux-2.6-v4l-dvb-add-kworld-a340-support.patch
 Patch2912: linux-2.6-v4l-dvb-ir-core-update.patch
+Patch2913: linux-2.6-v4l-dvb-ir-core-memleak-fixes.patch
 
 Patch2915: lirc-staging-2.6.36.patch
 #Patch2916: lirc-staging-2.6.36-fixes.patch
@@ -1251,6 +1252,7 @@ ApplyOptionalPatch linux-2.6-v4l-dvb-experimental.patch
 ApplyPatch linux-2.6-v4l-dvb-uvcvideo-update.patch
 
 ApplyPatch linux-2.6-v4l-dvb-ir-core-update.patch
+ApplyPatch linux-2.6-v4l-dvb-ir-core-memleak-fixes.patch
 ApplyPatch linux-2.6-v4l-dvb-add-lgdt3304-support.patch
 ApplyPatch linux-2.6-v4l-dvb-add-kworld-a340-support.patch
 
@@ -1868,6 +1870,7 @@ fi
 - lirc staging update
 - update kworld patch to one committed upstream
 - can't believe how much nicer dist-git is than dist-cvs
+- patch memory leaks in mceusb and imon drivers
 
 * Fri Jul 30 2010 Dave Jones <davej@redhat.com>
 - Enable PPS (#619392)
diff --git a/linux-2.6-v4l-dvb-ir-core-memleak-fixes.patch b/linux-2.6-v4l-dvb-ir-core-memleak-fixes.patch
new file mode 100644
index 000000000..59ba20a43
--- /dev/null
+++ b/linux-2.6-v4l-dvb-ir-core-memleak-fixes.patch
@@ -0,0 +1,142 @@
+ drivers/media/IR/imon.c   |   20 +-------------------
+ drivers/media/IR/mceusb.c |   15 +--------------
+ 2 files changed, 2 insertions(+), 33 deletions(-)
+
+diff --git a/drivers/media/IR/imon.c b/drivers/media/IR/imon.c
+index 65c125e..c185422 100644
+--- a/drivers/media/IR/imon.c
++++ b/drivers/media/IR/imon.c
+@@ -87,7 +87,6 @@ static ssize_t lcd_write(struct file *file, const char *buf,
+ struct imon_context {
+ 	struct device *dev;
+ 	struct ir_dev_props *props;
+-	struct ir_input_dev *ir;
+ 	/* Newer devices have two interfaces */
+ 	struct usb_device *usbdev_intf0;
+ 	struct usb_device *usbdev_intf1;
+@@ -1656,7 +1655,6 @@ static struct input_dev *imon_init_idev(struct imon_context *ictx)
+ {
+ 	struct input_dev *idev;
+ 	struct ir_dev_props *props;
+-	struct ir_input_dev *ir;
+ 	int ret, i;
+ 
+ 	idev = input_allocate_device();
+@@ -1671,12 +1669,6 @@ static struct input_dev *imon_init_idev(struct imon_context *ictx)
+ 		goto props_alloc_failed;
+ 	}
+ 
+-	ir = kzalloc(sizeof(struct ir_input_dev), GFP_KERNEL);
+-	if (!ir) {
+-		dev_err(ictx->dev, "remote ir input dev allocation failed\n");
+-		goto ir_dev_alloc_failed;
+-	}
+-
+ 	snprintf(ictx->name_idev, sizeof(ictx->name_idev),
+ 		 "iMON Remote (%04x:%04x)", ictx->vendor, ictx->product);
+ 	idev->name = ictx->name_idev;
+@@ -1706,14 +1698,9 @@ static struct input_dev *imon_init_idev(struct imon_context *ictx)
+ 	props->change_protocol = imon_ir_change_protocol;
+ 	ictx->props = props;
+ 
+-	ictx->ir = ir;
+-	memcpy(&ir->dev, ictx->dev, sizeof(struct device));
+-
+ 	usb_to_input_id(ictx->usbdev_intf0, &idev->id);
+ 	idev->dev.parent = ictx->dev;
+ 
+-	input_set_drvdata(idev, ir);
+-
+ 	ret = ir_input_register(idev, RC_MAP_IMON_PAD, props, MOD_NAME);
+ 	if (ret < 0) {
+ 		dev_err(ictx->dev, "remote input dev register failed\n");
+@@ -1723,8 +1710,6 @@ static struct input_dev *imon_init_idev(struct imon_context *ictx)
+ 	return idev;
+ 
+ idev_register_failed:
+-	kfree(ir);
+-ir_dev_alloc_failed:
+ 	kfree(props);
+ props_alloc_failed:
+ 	input_free_device(idev);
+@@ -1944,7 +1929,6 @@ static struct imon_context *imon_init_intf0(struct usb_interface *intf)
+ 
+ urb_submit_failed:
+ 	ir_input_unregister(ictx->idev);
+-	input_free_device(ictx->idev);
+ idev_setup_failed:
+ find_endpoint_failed:
+ 	mutex_unlock(&ictx->lock);
+@@ -2014,10 +1998,8 @@ static struct imon_context *imon_init_intf1(struct usb_interface *intf,
+ 	return ictx;
+ 
+ urb_submit_failed:
+-	if (ictx->touch) {
++	if (ictx->touch)
+ 		input_unregister_device(ictx->touch);
+-		input_free_device(ictx->touch);
+-	}
+ touch_setup_failed:
+ find_endpoint_failed:
+ 	mutex_unlock(&ictx->lock);
+diff --git a/drivers/media/IR/mceusb.c b/drivers/media/IR/mceusb.c
+index 78bf7f7..65b0738 100644
+--- a/drivers/media/IR/mceusb.c
++++ b/drivers/media/IR/mceusb.c
+@@ -228,7 +228,6 @@ static struct usb_device_id std_tx_mask_list[] = {
+ /* data structure for each usb transceiver */
+ struct mceusb_dev {
+ 	/* ir-core bits */
+-	struct ir_input_dev *irdev;
+ 	struct ir_dev_props *props;
+ 	struct ir_raw_event rawir;
+ 
+@@ -739,7 +738,7 @@ static void mceusb_dev_recv(struct urb *urb, struct pt_regs *regs)
+ 
+ 	if (ir->send_flags == RECV_FLAG_IN_PROGRESS) {
+ 		ir->send_flags = SEND_FLAG_COMPLETE;
+-		dev_dbg(&ir->irdev->dev, "setup answer received %d bytes\n",
++		dev_dbg(ir->dev, "setup answer received %d bytes\n",
+ 			buf_len);
+ 	}
+ 
+@@ -861,7 +860,6 @@ static struct input_dev *mceusb_init_input_dev(struct mceusb_dev *ir)
+ {
+ 	struct input_dev *idev;
+ 	struct ir_dev_props *props;
+-	struct ir_input_dev *irdev;
+ 	struct device *dev = ir->dev;
+ 	int ret = -ENODEV;
+ 
+@@ -878,12 +876,6 @@ static struct input_dev *mceusb_init_input_dev(struct mceusb_dev *ir)
+ 		goto props_alloc_failed;
+ 	}
+ 
+-	irdev = kzalloc(sizeof(struct ir_input_dev), GFP_KERNEL);
+-	if (!irdev) {
+-		dev_err(dev, "remote ir input dev allocation failed\n");
+-		goto ir_dev_alloc_failed;
+-	}
+-
+ 	snprintf(ir->name, sizeof(ir->name), "Media Center Ed. eHome "
+ 		 "Infrared Remote Transceiver (%04x:%04x)",
+ 		 le16_to_cpu(ir->usbdev->descriptor.idVendor),
+@@ -902,9 +894,6 @@ static struct input_dev *mceusb_init_input_dev(struct mceusb_dev *ir)
+ 	props->tx_ir = mceusb_tx_ir;
+ 
+ 	ir->props = props;
+-	ir->irdev = irdev;
+-
+-	input_set_drvdata(idev, irdev);
+ 
+ 	ret = ir_input_register(idev, RC_MAP_RC6_MCE, props, DRIVER_NAME);
+ 	if (ret < 0) {
+@@ -915,8 +904,6 @@ static struct input_dev *mceusb_init_input_dev(struct mceusb_dev *ir)
+ 	return idev;
+ 
+ irdev_failed:
+-	kfree(irdev);
+-ir_dev_alloc_failed:
+ 	kfree(props);
+ props_alloc_failed:
+ 	input_free_device(idev);