[PATCH] pinctrl: zte: fix 'functions' allocation in zx_pinctrl_build_state()

[PATCH] pinctrl: zte: fix 'functions' allocation in zx_pinctrl_build_state()

[Shawn Guo]

From: Shawn Guo <shawn.guo@linaro.org>

It fixes the following Smatch static check warning:

 drivers/pinctrl/zte/pinctrl-zx.c:338 zx_pinctrl_build_state()
 warn: passing devm_ allocated variable to kfree.

As we will be calling krealloc() on pointer 'functions', which means
kfree() will be called in there, devm_kzalloc() shouldn't be used with
the allocation in the first place.  Fix the warning by calling kcalloc()
and managing the free procedure in error path on our own.

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Fixes: cbff0c4d27f4 ("pinctrl: add ZTE ZX pinctrl driver support")
Signed-off-by: Shawn Guo <shawn.guo@linaro.org>
---
 drivers/pinctrl/zte/pinctrl-zx.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/pinctrl/zte/pinctrl-zx.c b/drivers/pinctrl/zte/pinctrl-zx.c
index f828ee340a98..ded366bb6564 100644
--- a/drivers/pinctrl/zte/pinctrl-zx.c
+++ b/drivers/pinctrl/zte/pinctrl-zx.c
@@ -295,8 +295,7 @@ static int zx_pinctrl_build_state(struct platform_device *pdev)
 	pctldev->num_groups = ngroups;
 
 	/* Build function list from pin mux functions */
-	functions = devm_kzalloc(&pdev->dev, info->npins * sizeof(*functions),
-				 GFP_KERNEL);
+	functions = kcalloc(info->npins, sizeof(*functions), GFP_KERNEL);
 	if (!functions)
 		return -ENOMEM;
 
@@ -367,8 +366,10 @@ static int zx_pinctrl_build_state(struct platform_device *pdev)
 						func->num_group_names *
 						sizeof(*func->group_names),
 						GFP_KERNEL);
-				if (!func->group_names)
+				if (!func->group_names) {
+					kfree(functions);
 					return -ENOMEM;
+				}
 			}
 
 			group = func->group_names;
-- 
1.9.1

Re: [PATCH] pinctrl: zte: fix 'functions' allocation in zx_pinctrl_build_state()

[Dan Carpenter]

Shouldn't there be a free if the remove function?  I'm not even sure
where the remove function is so I don't know.

regards,
dan carpenter

Re: [PATCH] pinctrl: zte: fix 'functions' allocation in zx_pinctrl_build_state()

[Shawn Guo]

On Mon, Jul 17, 2017 at 11:02:21AM +0300, Dan Carpenter wrote:
> Shouldn't there be a free if the remove function?  I'm not even sure
> where the remove function is so I don't know.

As the pinctrl driver is essential for the platform, it's always a
builtin_platform_driver which we do not even have a remove function.

Shawn

Re: [PATCH] pinctrl: zte: fix 'functions' allocation in zx_pinctrl_build_state()

[Dan Carpenter]

On Mon, Jul 17, 2017 at 05:46:24PM +0800, Shawn Guo wrote:
> On Mon, Jul 17, 2017 at 11:02:21AM +0300, Dan Carpenter wrote:
> > Shouldn't there be a free if the remove function?  I'm not even sure
> > where the remove function is so I don't know.
> 
> As the pinctrl driver is essential for the platform, it's always a
> builtin_platform_driver which we do not even have a remove function.
> 

Ah.  Good deal, then.

regards,
dan carpenter

Re: [PATCH] pinctrl: zte: fix 'functions' allocation in zx_pinctrl_build_state()

[Linus Walleij]

On Sun, Jul 16, 2017 at 3:33 PM, Shawn Guo <shawnguo@kernel.org> wrote:

> From: Shawn Guo <shawn.guo@linaro.org>
>
> It fixes the following Smatch static check warning:
>
>  drivers/pinctrl/zte/pinctrl-zx.c:338 zx_pinctrl_build_state()
>  warn: passing devm_ allocated variable to kfree.
>
> As we will be calling krealloc() on pointer 'functions', which means
> kfree() will be called in there, devm_kzalloc() shouldn't be used with
> the allocation in the first place.  Fix the warning by calling kcalloc()
> and managing the free procedure in error path on our own.
>
> Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
> Fixes: cbff0c4d27f4 ("pinctrl: add ZTE ZX pinctrl driver support")
> Signed-off-by: Shawn Guo <shawn.guo@linaro.org>

Patch applied.

Yours,
Linus Walleij