From: Dan Carpenter <dan.carpenter@oracle.com>
To: Lee Jones <lee.jones@linaro.org>
Cc: Mark Brown <broonie@opensource.wolfsonmicro.com>,
Marek Szyprowski <m.szyprowski@samsung.com>,
Samuel Ortiz <sameo@linux.intel.com>,
Liam Girdwood <lrg@slimlogic.co.uk>,
Kyungmin Park <kyungmin.park@samsung.com>,
linux-kernel@vger.kernel.org, kernel-janitors@vger.kernel.org
Subject: [PATCH] mfd: max8998: fix potential double free in probe
Date: Tue, 22 Sep 2020 08:14:16 +0000 [thread overview]
Message-ID: <20200922081416.GB1274646@mwanda> (raw)
The problem is that mfd_add_devices() calls mfd_remove_devices() on
failure and then the probe function will also call mfd_remove_devices().
I don't know exactly what problems this will cause but I'm pretty sure
that it will trigger the BUG_ON() at the start of ida_free().
One thing that this patch changes is that it adds a check for if
max8998_irq_init() fails.
Fixes: 156f252857df ("drivers: regulator: add Maxim 8998 driver")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
Checking max8998_irq_init() is slightly risky because sometimes these
functions have been failing and we didn't know.
drivers/mfd/max8998.c | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
diff --git a/drivers/mfd/max8998.c b/drivers/mfd/max8998.c
index 785f8e9841b7..9713c3ea4a63 100644
--- a/drivers/mfd/max8998.c
+++ b/drivers/mfd/max8998.c
@@ -202,7 +202,9 @@ static int max8998_i2c_probe(struct i2c_client *i2c,
}
i2c_set_clientdata(max8998->rtc, max8998);
- max8998_irq_init(max8998);
+ ret = max8998_irq_init(max8998);
+ if (ret)
+ goto unregister_dummy;
pm_runtime_set_active(max8998->dev);
@@ -222,15 +224,15 @@ static int max8998_i2c_probe(struct i2c_client *i2c,
}
if (ret < 0)
- goto err;
+ goto release_irq;
device_init_wakeup(max8998->dev, max8998->wakeup);
- return ret;
+ return 0;
-err:
- mfd_remove_devices(max8998->dev);
+release_irq:
max8998_irq_exit(max8998);
+unregister_dummy:
i2c_unregister_device(max8998->rtc);
return ret;
}
--
2.28.0
reply other threads:[~2020-09-22 8:14 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200922081416.GB1274646@mwanda \
--to=dan.carpenter@oracle.com \
--cc=broonie@opensource.wolfsonmicro.com \
--cc=kernel-janitors@vger.kernel.org \
--cc=kyungmin.park@samsung.com \
--cc=lee.jones@linaro.org \
--cc=linux-kernel@vger.kernel.org \
--cc=lrg@slimlogic.co.uk \
--cc=m.szyprowski@samsung.com \
--cc=sameo@linux.intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).