[bug report] media: stv090x: Implement probe/remove for stv090x

[Dan Carpenter <dan.carpenter@oracle.com>]

Hello Tobias Klausmann,

The patch eb5005df886b: "media: stv090x: Implement probe/remove for
stv090x" from May 29, 2019, leads to the following static checker
warning:

	drivers/media/dvb-frontends/stv090x.c:5032 stv090x_probe()
	warn: 'state' was already freed.

drivers/media/dvb-frontends/stv090x.c
  4994  static int stv090x_probe(struct i2c_client *client,
  4995                           const struct i2c_device_id *id)
  4996  {
  4997          int ret = 0;
  4998          struct stv090x_config *config = client->dev.platform_data;
  4999  
  5000          struct stv090x_state *state = NULL;
  5001  
  5002          state = kzalloc(sizeof(*state), GFP_KERNEL);
  5003          if (!state) {
  5004                  ret = -ENOMEM;
  5005                  goto error;
  5006          }
  5007  
  5008          state->verbose                          = &verbose;
  5009          state->config                           = config;
  5010          state->i2c                              = client->adapter;
  5011          state->frontend.ops                     = stv090x_ops;
  5012          state->frontend.demodulator_priv        = state;
  5013          state->demod                            = config->demod;
  5014                                                  /* Single or Dual mode */
  5015          state->demod_mode                       = config->demod_mode;
  5016          state->device                           = config->device;
  5017                                                  /* default */
  5018          state->rolloff                          = STV090x_RO_35;
  5019  
  5020          ret = stv090x_setup_compound(state);
  5021          if (ret)
  5022                  goto error;

stv090x_setup_compound() frees "state" on error.

  5023  
  5024          i2c_set_clientdata(client, state);
  5025  
  5026          /* setup callbacks */
  5027          config->get_dvb_frontend = stv090x_get_dvb_frontend;
  5028  
  5029          return 0;
  5030  
  5031  error:
  5032          kfree(state);
                ^^^^^^^^^^^^
Double free.

  5033          return ret;
  5034  }

regards,
dan carpenter