From: Dan Carpenter <dan.carpenter@oracle.com>
To: kernel-janitors@vger.kernel.org
Subject: Re: [iio:wip] drivers/staging/iio/iio_input.c:189 iio_input_probe() error: don't call input_free_dev
Date: Mon, 17 Sep 2012 10:57:52 +0000 [thread overview]
Message-ID: <20120917105752.GH4587@mwanda> (raw)
In-Reply-To: <20120915143547.GB7303@localhost>
On Sat, Sep 15, 2012 at 10:35:47PM +0800, Fengguang Wu wrote:
> Hi Jonathan,
>
> There is a smatch warning in tree
>
> git://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio.git wip
>
> + drivers/staging/iio/iio_input.c:189 iio_input_probe() error: don't call input_free_device() after input_unregister_device()
>
> vim +189 drivers/staging/iio/iio_input.c
>
> 186 error_unregister_input:
> 187 input_unregister_device(st->idev);
> 188 error_free_idev:
> > 189 input_free_device(st->idev);
In this case, it's obvious that we do reference "st->idev" after
calling input_unregister_device() so this is a bug. Normally way
people write this is to make input_register_device() the last call
in the probe() function which can fail. In this case, it's a bit
awkward to do that it looks like.
Anyway, it's a double free bug because
input_register/unregister_device() is ref counted.
regards,
dan carpenter
prev parent reply other threads:[~2012-09-17 10:57 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-09-15 14:35 [iio:wip] drivers/staging/iio/iio_input.c:189 iio_input_probe() error: don't call input_free_device( Fengguang Wu
2012-09-17 10:57 ` Dan Carpenter [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20120917105752.GH4587@mwanda \
--to=dan.carpenter@oracle.com \
--cc=kernel-janitors@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.