lkml.org 
[lkml]   [2010]   [Mar]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Date
    Subject[PATCH 14/24] misc: fix dangling pointers
    Fix I2C-drivers which missed setting clientdata to NULL before freeing the
    structure it points to. Also fix drivers which do this _after_ the structure
    was freed already.

    Signed-off-by: Wolfram Sang <w.sang@pengutronix.de>
    ---

    Found using coccinelle, then reviewed. Full patchset is available via
    kernel-janitors, linux-i2c, and LKML.
    ---
    drivers/misc/ad525x_dpot.c | 2 +-
    drivers/misc/ics932s401.c | 2 ++
    drivers/misc/isl29003.c | 6 +++++-
    drivers/misc/tsl2550.c | 6 +++++-
    4 files changed, 13 insertions(+), 3 deletions(-)

    diff --git a/drivers/misc/ad525x_dpot.c b/drivers/misc/ad525x_dpot.c
    index 30a59f2..3b6f437 100644
    --- a/drivers/misc/ad525x_dpot.c
    +++ b/drivers/misc/ad525x_dpot.c
    @@ -567,8 +567,8 @@ static int ad525x_probe(struct i2c_client *client,
    return 0;

    exit_free:
    - kfree(data);
    i2c_set_clientdata(client, NULL);
    + kfree(data);
    exit:
    dev_err(dev, "failed to create client\n");
    return err;
    diff --git a/drivers/misc/ics932s401.c b/drivers/misc/ics932s401.c
    index 395a4ea..f60b7e7 100644
    --- a/drivers/misc/ics932s401.c
    +++ b/drivers/misc/ics932s401.c
    @@ -465,6 +465,7 @@ static int ics932s401_probe(struct i2c_client *client,
    return 0;

    exit_free:
    + i2c_set_clientdata(client, NULL);
    kfree(data);
    exit:
    return err;
    @@ -475,6 +476,7 @@ static int ics932s401_remove(struct i2c_client *client)
    struct ics932s401_data *data = i2c_get_clientdata(client);

    sysfs_remove_group(&client->dev.kobj, &data->attrs);
    + i2c_set_clientdata(client, NULL);
    kfree(data);
    return 0;
    }
    diff --git a/drivers/misc/isl29003.c b/drivers/misc/isl29003.c
    index a71e245..5bd4d8b 100644
    --- a/drivers/misc/isl29003.c
    +++ b/drivers/misc/isl29003.c
    @@ -397,15 +397,19 @@ static int __devinit isl29003_probe(struct i2c_client *client,
    return 0;

    exit_kfree:
    + i2c_set_clientdata(client, NULL);
    kfree(data);
    return err;
    }

    static int __devexit isl29003_remove(struct i2c_client *client)
    {
    + struct isl29003_data *data = i2c_get_clientdata(client);
    +
    sysfs_remove_group(&client->dev.kobj, &isl29003_attr_group);
    isl29003_set_power_state(client, 0);
    - kfree(i2c_get_clientdata(client));
    + i2c_set_clientdata(client, NULL);
    + kfree(data);
    return 0;
    }

    diff --git a/drivers/misc/tsl2550.c b/drivers/misc/tsl2550.c
    index 483ae5f..230c326 100644
    --- a/drivers/misc/tsl2550.c
    +++ b/drivers/misc/tsl2550.c
    @@ -400,6 +400,7 @@ static int __devinit tsl2550_probe(struct i2c_client *client,
    return 0;

    exit_kfree:
    + i2c_set_clientdata(client, NULL);
    kfree(data);
    exit:
    return err;
    @@ -407,12 +408,15 @@ exit:

    static int __devexit tsl2550_remove(struct i2c_client *client)
    {
    + struct tsl2550_data *data = i2c_get_clientdata(client);
    +
    sysfs_remove_group(&client->dev.kobj, &tsl2550_attr_group);

    /* Power down the device */
    tsl2550_set_power_state(client, 0);

    - kfree(i2c_get_clientdata(client));
    + i2c_set_clientdata(client, NULL);
    + kfree(data);

    return 0;
    }
    --
    1.7.0


    \
     
     \ /
      Last update: 2010-03-20 15:17    [W:0.026 / U:34.776 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site