summaryrefslogtreecommitdiffstats
path: root/drivers/power
diff options
context:
space:
mode:
authorJulia Lawall <julia.lawall@lip6.fr>2013-01-06 12:46:23 -0800
committerAnton Vorontsov <anton@enomsg.org>2013-01-06 12:46:23 -0800
commit0853699252afdeece69c9127d57fd367d3c04a35 (patch)
tree591115b3f18593cf52f358ac52960a6e48a50182 /drivers/power
parent8feffd109977c045669913f4e80e8811f2212cd9 (diff)
downloadlinux-0853699252afdeece69c9127d57fd367d3c04a35.tar.bz2
88pm860x_battery: Eliminate possible references to released resources
devm_kzalloc should not be followed by kfree, as this results in a double free. The problem was found using the following semantic match (http://coccinelle.lip6.fr/): // <smpl> @@ expression x,e; @@ x = devm_kzalloc(...) ... when != x = e ?-kfree(x,...); // </smpl> Furthermore, in the remove function, the calls to free_irq are moved up to prevent a possible reference in the interrupt handler to resources freed by power_supply_unregister. Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr> Signed-off-by: Anton Vorontsov <anton@enomsg.org>
Diffstat (limited to 'drivers/power')
-rw-r--r--drivers/power/88pm860x_battery.c13
1 files changed, 4 insertions, 9 deletions
diff --git a/drivers/power/88pm860x_battery.c b/drivers/power/88pm860x_battery.c
index 8bc80b05c63c..d338c1c4e8c8 100644
--- a/drivers/power/88pm860x_battery.c
+++ b/drivers/power/88pm860x_battery.c
@@ -915,15 +915,13 @@ static int pm860x_battery_probe(struct platform_device *pdev)
info->irq_cc = platform_get_irq(pdev, 0);
if (info->irq_cc <= 0) {
dev_err(&pdev->dev, "No IRQ resource!\n");
- ret = -EINVAL;
- goto out;
+ return -EINVAL;
}
info->irq_batt = platform_get_irq(pdev, 1);
if (info->irq_batt <= 0) {
dev_err(&pdev->dev, "No IRQ resource!\n");
- ret = -EINVAL;
- goto out;
+ return -EINVAL;
}
info->chip = chip;
@@ -957,7 +955,7 @@ static int pm860x_battery_probe(struct platform_device *pdev)
ret = power_supply_register(&pdev->dev, &info->battery);
if (ret)
- goto out;
+ return ret;
info->battery.dev->parent = &pdev->dev;
ret = request_threaded_irq(info->irq_cc, NULL,
@@ -984,8 +982,6 @@ out_coulomb:
free_irq(info->irq_cc, info);
out_reg:
power_supply_unregister(&info->battery);
-out:
- kfree(info);
return ret;
}
@@ -993,10 +989,9 @@ static int pm860x_battery_remove(struct platform_device *pdev)
{
struct pm860x_battery_info *info = platform_get_drvdata(pdev);
- power_supply_unregister(&info->battery);
free_irq(info->irq_batt, info);
free_irq(info->irq_cc, info);
- kfree(info);
+ power_supply_unregister(&info->battery);
platform_set_drvdata(pdev, NULL);
return 0;
}