From: Dan Carpenter <dan.carpenter@oracle.com>
To: kernel-janitors@vger.kernel.org
Subject: Re: [iio:wip] drivers/staging/iio/iio_input.c:189 iio_input_probe() error: don't call input_free_dev
Date: Mon, 17 Sep 2012 10:57:52 +0000 [thread overview]
Message-ID: <20120917105752.GH4587@mwanda> (raw)
In-Reply-To: <20120915143547.GB7303@localhost>
On Sat, Sep 15, 2012 at 10:35:47PM +0800, Fengguang Wu wrote:
> Hi Jonathan,
>
> There is a smatch warning in tree
>
> git://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio.git wip
>
> + drivers/staging/iio/iio_input.c:189 iio_input_probe() error: don't call input_free_device() after input_unregister_device()
>
> vim +189 drivers/staging/iio/iio_input.c
>
> 186 error_unregister_input:
> 187 input_unregister_device(st->idev);
> 188 error_free_idev:
> > 189 input_free_device(st->idev);
In this case, it's obvious that we do reference "st->idev" after
calling input_unregister_device() so this is a bug. Normally way
people write this is to make input_register_device() the last call
in the probe() function which can fail. In this case, it's a bit
awkward to do that it looks like.
Anyway, it's a double free bug because
input_register/unregister_device() is ref counted.
regards,
dan carpenter
prev parent reply other threads:[~2012-09-17 10:57 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-09-15 14:35 [iio:wip] drivers/staging/iio/iio_input.c:189 iio_input_probe() error: don't call input_free_device( Fengguang Wu
2012-09-17 10:57 ` Dan Carpenter [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20120917105752.GH4587@mwanda \
--to=dan.carpenter@oracle.com \
--cc=kernel-janitors@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox