diff mbox

gpio/omap: fix possible memory leak in omap2_gpio_dev_init()

Message ID CAPgLHd9A0-Esqt8D87RunMWFFG7uTCERksia26DSO1xw8OUfmg@mail.gmail.com (mailing list archive)
State New, archived
Headers show

Commit Message

Wei Yongjun Sept. 3, 2012, 10:13 a.m. UTC 
From: Wei Yongjun <yongjun_wei@trendmicro.com.cn>

pdata and pdata->regs have been allocated in this function and 
should be freed before leaving it, and in the other error handling
cases too.

spatch with a semantic match is used to found this problem.
(http://coccinelle.lip6.fr/)

Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
---
 arch/arm/mach-omap2/gpio.c | 3 +++
 1 file changed, 3 insertions(+)



--
To unsubscribe from this list: send the line "unsubscribe linux-omap" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Comments

Russell King - ARM Linux Sept. 3, 2012, 11:11 a.m. UTC | #1 
On Mon, Sep 03, 2012 at 06:13:33PM +0800, Wei Yongjun wrote:
> @@ -130,6 +132,7 @@ static int __init omap2_gpio_dev_init(struct omap_hwmod *oh, void *unused)
>  
>  	pdev = omap_device_build(name, id - 1, oh, pdata,
>  				sizeof(*pdata),	NULL, 0, false);
> +	kfree(pdata->regs);
>  	kfree(pdata);

This one looks wrong.  pdata is copied by the internals of
omap_device_build(), which includes the 'regs' pointer, so it should not
be freed after a successful call to omap_device_build().  (It should,
however, be freed after an unsuccessful call.)

BTW, you want to copy Paul Walmsley with this patch (address in Cc).
--
To unsubscribe from this list: send the line "unsubscribe linux-omap" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

diff --git a/arch/arm/mach-omap2/gpio.c b/arch/arm/mach-omap2/gpio.c
index 9ad7d48..3bfa4bb 100644
--- a/arch/arm/mach-omap2/gpio.c
+++ b/arch/arm/mach-omap2/gpio.c
@@ -60,6 +60,7 @@  static int __init omap2_gpio_dev_init(struct omap_hwmod *oh, void *unused)
 	pdata->regs = kzalloc(sizeof(struct omap_gpio_reg_offs), GFP_KERNEL);
 	if (!pdata->regs) {
 		pr_err("gpio%d: Memory allocation failed\n", id);
+		kfree(pdata);
 		return -ENOMEM;
 	}
 
@@ -121,6 +122,7 @@  static int __init omap2_gpio_dev_init(struct omap_hwmod *oh, void *unused)
 		break;
 	default:
 		WARN(1, "Invalid gpio bank_type\n");
+		kfree(pdata->regs);
 		kfree(pdata);
 		return -EINVAL;
 	}
@@ -130,6 +132,7 @@  static int __init omap2_gpio_dev_init(struct omap_hwmod *oh, void *unused)
 
 	pdev = omap_device_build(name, id - 1, oh, pdata,
 				sizeof(*pdata),	NULL, 0, false);
+	kfree(pdata->regs);
 	kfree(pdata);
 
 	if (IS_ERR(pdev)) {