diff mbox series

iio: imu: adis16400: release allocated memory on failure

Message ID 20190918165724.3758-1-navid.emamdoost@gmail.com (mailing list archive)
State New, archived
Headers show
Series iio: imu: adis16400: release allocated memory on failure | expand

Commit Message

Navid Emamdoost Sept. 18, 2019, 4:57 p.m. UTC
In adis_update_scan_mode, if allocation for adis->buffer fails,
previously allocated adis->xfer needs to be released.

Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
---
 drivers/iio/imu/adis_buffer.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

Comments

Alexandru Ardelean Sept. 19, 2019, 6:51 a.m. UTC | #1
On Wed, 2019-09-18 at 11:57 -0500, Navid Emamdoost wrote:
> [External]
> 

Hey,

Good catch.
One comment inline.

> In adis_update_scan_mode, if allocation for adis->buffer fails,
> previously allocated adis->xfer needs to be released.
> 
> Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
> ---
>  drivers/iio/imu/adis_buffer.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/iio/imu/adis_buffer.c
> b/drivers/iio/imu/adis_buffer.c
> index 9ac8356d9a95..c5d7e368a636 100644
> --- a/drivers/iio/imu/adis_buffer.c
> +++ b/drivers/iio/imu/adis_buffer.c
> @@ -78,8 +78,10 @@ int adis_update_scan_mode(struct iio_dev *indio_dev,
>  		return -ENOMEM;
>  
>  	adis->buffer = kcalloc(indio_dev->scan_bytes, 2, GFP_KERNEL);
> -	if (!adis->buffer)
> +	if (!adis->buffer) {
> +		kfree(adis->xfer);

Maybe also do  "adis->xfer = NULL" here.
The idea is to make sure that the pointer is not double-free'd by some
other function (i.e. adis_cleanup_buffer_and_trigger() or another
adis_update_scan_mode() call).

>  		return -ENOMEM;
> +	}
>  
>  	rx = adis->buffer;
>  	tx = rx + scan_count;
diff mbox series

Patch

diff --git a/drivers/iio/imu/adis_buffer.c b/drivers/iio/imu/adis_buffer.c
index 9ac8356d9a95..c5d7e368a636 100644
--- a/drivers/iio/imu/adis_buffer.c
+++ b/drivers/iio/imu/adis_buffer.c
@@ -78,8 +78,10 @@  int adis_update_scan_mode(struct iio_dev *indio_dev,
 		return -ENOMEM;
 
 	adis->buffer = kcalloc(indio_dev->scan_bytes, 2, GFP_KERNEL);
-	if (!adis->buffer)
+	if (!adis->buffer) {
+		kfree(adis->xfer);
 		return -ENOMEM;
+	}
 
 	rx = adis->buffer;
 	tx = rx + scan_count;