[PATCH] iio: inkern: call iio_device_put() only on mapped devices

[PATCH] iio: inkern: call iio_device_put() only on mapped devices

[Joe Hattori]

In the error path of iio_channel_get_all(), iio_device_put() is called
on all IIO devices, which can cause a refcount imbalance. Fix this error
by calling iio_device_put() only on IIO devices whose refcounts were
previously incremented by iio_device_get().

Fixes: 314be14bb893 ("iio: Rename _st_ functions to loose the bit that meant the staging version.")
Signed-off-by: Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp>
---
 drivers/iio/inkern.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/iio/inkern.c b/drivers/iio/inkern.c
index 136b225b6bc8..9050a59129e6 100644
--- a/drivers/iio/inkern.c
+++ b/drivers/iio/inkern.c
@@ -500,7 +500,7 @@ struct iio_channel *iio_channel_get_all(struct device *dev)
 	return_ptr(chans);
 
 error_free_chans:
-	for (i = 0; i < nummaps; i++)
+	for (i = 0; i < mapind; i++)
 		iio_device_put(chans[i].indio_dev);
 	return ERR_PTR(ret);
 }
-- 
2.34.1

Re: [PATCH] iio: inkern: call iio_device_put() only on mapped devices

[Jonathan Cameron]

On Wed,  4 Dec 2024 20:13:42 +0900
Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp> wrote:

> In the error path of iio_channel_get_all(), iio_device_put() is called
> on all IIO devices, which can cause a refcount imbalance. Fix this error
> by calling iio_device_put() only on IIO devices whose refcounts were
> previously incremented by iio_device_get().
> 
> Fixes: 314be14bb893 ("iio: Rename _st_ functions to loose the bit that meant the staging version.")
> Signed-off-by: Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp>
Applied to the fixes-togreg branch of iio.git and marked for stable.

Thanks,

Jonathan

> ---
>  drivers/iio/inkern.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/iio/inkern.c b/drivers/iio/inkern.c
> index 136b225b6bc8..9050a59129e6 100644
> --- a/drivers/iio/inkern.c
> +++ b/drivers/iio/inkern.c
> @@ -500,7 +500,7 @@ struct iio_channel *iio_channel_get_all(struct device *dev)
>  	return_ptr(chans);
>  
>  error_free_chans:
> -	for (i = 0; i < nummaps; i++)
> +	for (i = 0; i < mapind; i++)
>  		iio_device_put(chans[i].indio_dev);
>  	return ERR_PTR(ret);
>  }