lkml.org 
[lkml]   [2010]   [Mar]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Date
Subject[PATCH 18/24] rtc: fix dangling pointers
Fix I2C-drivers which missed setting clientdata to NULL before freeing the
structure it points to. Also fix drivers which do this _after_ the structure
was freed already.

Signed-off-by: Wolfram Sang <w.sang@pengutronix.de>
Cc: Paul Gortmaker <p_gortmaker@yahoo.com>
Cc: Alessandro Zummo <a.zummo@towertech.it>
---

Found using coccinelle, then reviewed. Full patchset is available via
kernel-janitors, linux-i2c, and LKML.
---
drivers/rtc/rtc-ds1307.c | 2 ++
drivers/rtc/rtc-fm3130.c | 2 ++
drivers/rtc/rtc-m41t80.c | 2 ++
drivers/rtc/rtc-pcf8563.c | 2 ++
drivers/rtc/rtc-pcf8583.c | 2 ++
drivers/rtc/rtc-rs5c372.c | 2 ++
drivers/rtc/rtc-s35390a.c | 4 ++--
7 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/drivers/rtc/rtc-ds1307.c b/drivers/rtc/rtc-ds1307.c
index c4ec5c1..eee887c 100644
--- a/drivers/rtc/rtc-ds1307.c
+++ b/drivers/rtc/rtc-ds1307.c
@@ -900,6 +900,7 @@ read_rtc:
exit_irq:
rtc_device_unregister(ds1307->rtc);
exit_free:
+ i2c_set_clientdata(client, NULL);
kfree(ds1307);
return err;
}
@@ -917,6 +918,7 @@ static int __devexit ds1307_remove(struct i2c_client *client)
sysfs_remove_bin_file(&client->dev.kobj, &nvram);

rtc_device_unregister(ds1307->rtc);
+ i2c_set_clientdata(client, NULL);
kfree(ds1307);
return 0;
}
diff --git a/drivers/rtc/rtc-fm3130.c b/drivers/rtc/rtc-fm3130.c
index 812c667..6c4e90f 100644
--- a/drivers/rtc/rtc-fm3130.c
+++ b/drivers/rtc/rtc-fm3130.c
@@ -462,6 +462,7 @@ exit_bad:
}
return 0;
exit_free:
+ i2c_set_clientdata(client, NULL);
kfree(fm3130);
return err;
}
@@ -471,6 +472,7 @@ static int __devexit fm3130_remove(struct i2c_client *client)
struct fm3130 *fm3130 = i2c_get_clientdata(client);

rtc_device_unregister(fm3130->rtc);
+ i2c_set_clientdata(client, NULL);
kfree(fm3130);
return 0;
}
diff --git a/drivers/rtc/rtc-m41t80.c b/drivers/rtc/rtc-m41t80.c
index 60fe266..2fd8d7c 100644
--- a/drivers/rtc/rtc-m41t80.c
+++ b/drivers/rtc/rtc-m41t80.c
@@ -863,6 +863,7 @@ ht_err:
exit:
if (rtc)
rtc_device_unregister(rtc);
+ i2c_set_clientdata(client, NULL);
kfree(clientdata);
return rc;
}
@@ -880,6 +881,7 @@ static int m41t80_remove(struct i2c_client *client)
#endif
if (rtc)
rtc_device_unregister(rtc);
+ i2c_set_clientdata(client, NULL);
kfree(clientdata);

return 0;
diff --git a/drivers/rtc/rtc-pcf8563.c b/drivers/rtc/rtc-pcf8563.c
index 65f346b..4be76a4 100644
--- a/drivers/rtc/rtc-pcf8563.c
+++ b/drivers/rtc/rtc-pcf8563.c
@@ -225,6 +225,7 @@ static int pcf8563_probe(struct i2c_client *client,
return 0;

exit_kfree:
+ i2c_set_clientdata(client, NULL);
kfree(pcf8563);

return err;
@@ -237,6 +238,7 @@ static int pcf8563_remove(struct i2c_client *client)
if (pcf8563->rtc)
rtc_device_unregister(pcf8563->rtc);

+ i2c_set_clientdata(client, NULL);
kfree(pcf8563);

return 0;
diff --git a/drivers/rtc/rtc-pcf8583.c b/drivers/rtc/rtc-pcf8583.c
index 2d201af..e122d9f 100644
--- a/drivers/rtc/rtc-pcf8583.c
+++ b/drivers/rtc/rtc-pcf8583.c
@@ -290,6 +290,7 @@ static int pcf8583_probe(struct i2c_client *client,
return 0;

exit_kfree:
+ i2c_set_clientdata(client, NULL);
kfree(pcf8583);
return err;
}
@@ -300,6 +301,7 @@ static int __devexit pcf8583_remove(struct i2c_client *client)

if (pcf8583->rtc)
rtc_device_unregister(pcf8583->rtc);
+ i2c_set_clientdata(client, NULL);
kfree(pcf8583);
return 0;
}
diff --git a/drivers/rtc/rtc-rs5c372.c b/drivers/rtc/rtc-rs5c372.c
index 2f2c68d..75e0423 100644
--- a/drivers/rtc/rtc-rs5c372.c
+++ b/drivers/rtc/rtc-rs5c372.c
@@ -694,6 +694,7 @@ exit_devreg:
rtc_device_unregister(rs5c372->rtc);

exit_kfree:
+ i2c_set_clientdata(client, NULL);
kfree(rs5c372);

exit:
@@ -706,6 +707,7 @@ static int rs5c372_remove(struct i2c_client *client)

rtc_device_unregister(rs5c372->rtc);
rs5c_sysfs_unregister(&client->dev);
+ i2c_set_clientdata(client, NULL);
kfree(rs5c372);
return 0;
}
diff --git a/drivers/rtc/rtc-s35390a.c b/drivers/rtc/rtc-s35390a.c
index def4d39..da39041 100644
--- a/drivers/rtc/rtc-s35390a.c
+++ b/drivers/rtc/rtc-s35390a.c
@@ -274,8 +274,8 @@ exit_dummy:
for (i = 1; i < 8; ++i)
if (s35390a->client[i])
i2c_unregister_device(s35390a->client[i]);
- kfree(s35390a);
i2c_set_clientdata(client, NULL);
+ kfree(s35390a);

exit:
return err;
@@ -291,8 +291,8 @@ static int s35390a_remove(struct i2c_client *client)
i2c_unregister_device(s35390a->client[i]);

rtc_device_unregister(s35390a->rtc);
- kfree(s35390a);
i2c_set_clientdata(client, NULL);
+ kfree(s35390a);

return 0;
}
--
1.7.0


\
 
 \ /
  Last update: 2010-03-20 15:19    [W:0.515 / U:9.872 seconds]
©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site