[PATCH] Fix various memory leaks

From: Yury Umanets <torque@ukrpost.net>

Thanks to smatch I have found few memory leaks and other related issues.

drivers/usb/input/hiddev.c

@@ -612,7 +612,7 @@ static int hiddev_ioctl(struct inode *inode, struct file *file, unsigned int cmd
 		uref = &uref_multi->uref;
 		if (cmd == HIDIOCGUSAGES || cmd == HIDIOCSUSAGES) {
 			if (copy_from_user(uref_multi, (void *) arg, 
-					   sizeof(uref_multi)))
+					   sizeof(*uref_multi)))
 				goto fault;
 		} else {
 			if (copy_from_user(uref, (void *) arg, sizeof(*uref)))

drivers/usb/misc/emi26.c

@@ -194,7 +194,7 @@ static int emi26_load_firmware (struct usb_device *dev)
 
 	/* return 1 to fail the driver inialization
 	 * and give real driver change to load */
-	return 1;
+	err = 1;
 
 wraperr:
 	kfree(buf);

drivers/usb/misc/emi62.c

@@ -229,6 +229,8 @@ static int emi62_load_firmware (struct usb_device *dev)
 		goto wraperr;
 	}
 
+	kfree(buf);
+
 	/* return 1 to fail the driver inialization
 	 * and give real driver change to load */
 	return 1;

drivers/video/aty/atyfb_base.c

@@ -1938,6 +1938,19 @@ int __init atyfb_init(void)
 			if (i < 0)
 				continue;
 
+			rp = &pdev->resource[0];
+			if (rp->flags & IORESOURCE_IO)
+				rp = &pdev->resource[1];
+			addr = rp->start;
+			if (!addr)
+				continue;
+
+			res_start = rp->start;
+			res_size = rp->end - rp->start + 1;
+			if (!request_mem_region
+			    (res_start, res_size, "atyfb"))
+				continue;
+
 			info =
 			    kmalloc(sizeof(struct fb_info), GFP_ATOMIC);
 			if (!info) {
@@ -1960,19 +1973,6 @@ int __init atyfb_init(void)
 			info->fix = atyfb_fix;
 			info->par = default_par;
 
-			rp = &pdev->resource[0];
-			if (rp->flags & IORESOURCE_IO)
-				rp = &pdev->resource[1];
-			addr = rp->start;
-			if (!addr)
-				continue;
-
-			res_start = rp->start;
-			res_size = rp->end - rp->start + 1;
-			if (!request_mem_region
-			    (res_start, res_size, "atyfb"))
-				continue;
-
 #ifdef __sparc__
 			/*
 			 * Map memory-mapped registers.
@@ -2000,6 +2000,7 @@ int __init atyfb_init(void)
 			if (!default_par->mmap_map) {
 				printk
 				    ("atyfb_init: can't alloc mmap_map\n");
+				kfree(default_par);
 				kfree(info);
 				release_mem_region(res_start, res_size);
 				return -ENXIO;
@@ -2217,6 +2218,9 @@ int __init atyfb_init(void)
 			    ioremap(info->fix.mmio_start, 0x1000);
 
 			if (!default_par->ati_regbase) {
+#ifdef __sparc__
+				kfree(default_par->mmap_map);
+#endif
 				kfree(default_par);
 				kfree(info);
 				release_mem_region(res_start, res_size);
@@ -2247,6 +2251,10 @@ int __init atyfb_init(void)
 			    (char *) ioremap(addr, 0x800000);
 
 			if (!info->screen_base) {
+#ifdef __sparc__
+				kfree(default_par->mmap_map);
+#endif
+				kfree(default_par);
 				kfree(info);
 				release_mem_region(res_start, res_size);
 				return -ENXIO;
@@ -2258,6 +2266,7 @@ int __init atyfb_init(void)
 				if (default_par->mmap_map)
 					kfree(default_par->mmap_map);
 #endif
+				kfree(default_par);
 				kfree(info);
 				release_mem_region(res_start, res_size);
 				return -ENXIO;
@@ -2326,6 +2335,7 @@ int __init atyfb_init(void)
 		memset(default_par, 0, sizeof(struct atyfb_par));
 
 		info->fix = atyfb_fix;
+		info->par = default_par;
 
 		/*
 		 *  Map the video memory (physical address given) to somewhere in the
@@ -2357,6 +2367,7 @@ int __init atyfb_init(void)
 		}
 
 		if (!aty_init(info, "ISA bus")) {
+			kfree(default_par);
 			kfree(info);
 			/* This is insufficient! kernel_map has added two large chunks!! */
 			return -ENXIO;

net/irda/ircomm/ircomm_tty.c

@@ -721,8 +721,10 @@ static int ircomm_tty_write(struct tty_struct *tty, int from_user,
 		kbuf = kmalloc(count, GFP_KERNEL);
 		if (kbuf == NULL)
 			return -ENOMEM;
-		if (copy_from_user(kbuf, ubuf, count))
+		if (copy_from_user(kbuf, ubuf, count)) {
+			kfree(kbuf);
 			return -EFAULT;
+		}
 	} else
 		/* The buffer is already in kernel space */
 		kbuf = (unsigned char *) ubuf;
@@ -779,6 +781,8 @@ static int ircomm_tty_write(struct tty_struct *tty, int from_user,
 					    self->max_header_size);
 			if (!skb) {
 				spin_unlock_irqrestore(&self->spinlock, flags);
+	                        if (from_user)
+		                        kfree(kbuf);
 				return -ENOBUFS;
 			}
 			skb_reserve(skb, self->max_header_size);