[PATCH] gpio/omap: fix possible memory leak in omap2_gpio_dev_init()

[PATCH] gpio/omap: fix possible memory leak in omap2_gpio_dev_init()

[Wei Yongjun]

From: Wei Yongjun <yongjun_wei@trendmicro.com.cn>

pdata and pdata->regs have been allocated in this function and 
should be freed before leaving it, and in the other error handling
cases too.

spatch with a semantic match is used to found this problem.
(http://coccinelle.lip6.fr/)

Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
---
 arch/arm/mach-omap2/gpio.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/arch/arm/mach-omap2/gpio.c b/arch/arm/mach-omap2/gpio.c
index 9ad7d48..3bfa4bb 100644
--- a/arch/arm/mach-omap2/gpio.c
+++ b/arch/arm/mach-omap2/gpio.c
@@ -60,6 +60,7 @@ static int __init omap2_gpio_dev_init(struct omap_hwmod *oh, void *unused)
 	pdata->regs = kzalloc(sizeof(struct omap_gpio_reg_offs), GFP_KERNEL);
 	if (!pdata->regs) {
 		pr_err("gpio%d: Memory allocation failed\n", id);
+		kfree(pdata);
 		return -ENOMEM;
 	}
 
@@ -121,6 +122,7 @@ static int __init omap2_gpio_dev_init(struct omap_hwmod *oh, void *unused)
 		break;
 	default:
 		WARN(1, "Invalid gpio bank_type\n");
+		kfree(pdata->regs);
 		kfree(pdata);
 		return -EINVAL;
 	}
@@ -130,6 +132,7 @@ static int __init omap2_gpio_dev_init(struct omap_hwmod *oh, void *unused)
 
 	pdev = omap_device_build(name, id - 1, oh, pdata,
 				sizeof(*pdata),	NULL, 0, false);
+	kfree(pdata->regs);
 	kfree(pdata);
 
 	if (IS_ERR(pdev)) {

[PATCH] gpio/omap: fix possible memory leak in omap2_gpio_dev_init()

[Russell King - ARM Linux]

On Mon, Sep 03, 2012 at 06:13:33PM +0800, Wei Yongjun wrote:
> @@ -130,6 +132,7 @@ static int __init omap2_gpio_dev_init(struct omap_hwmod *oh, void *unused)
>  
>  	pdev = omap_device_build(name, id - 1, oh, pdata,
>  				sizeof(*pdata),	NULL, 0, false);
> +	kfree(pdata->regs);
>  	kfree(pdata);

This one looks wrong.  pdata is copied by the internals of
omap_device_build(), which includes the 'regs' pointer, so it should not
be freed after a successful call to omap_device_build().  (It should,
however, be freed after an unsuccessful call.)

BTW, you want to copy Paul Walmsley with this patch (address in Cc).