Re: [PATCH 1/2] lp8727_charger: free_irq when lp8727_register_psy fail

Devendra Naga
2012-08-23T16:52:33Z

Hi Anton,

On Mon, Aug 20, 2012 at 2:20 AM, Anton Vorontsov <cbouatmailru@gmail.com> wrote:
> On Fri, Aug 10, 2012 at 10:05:55AM +0530, Devendra wrote:
>> Sorry Guys on disturbing you,
>>
>> Will you guys please ACK, NACK or comment on this?
>
> Technically, it looks OK. But the irq registration logic is sill broken,
> and the hidden issue is much more serious.
>
> 1. lp8727_init_device() -> the function enables interrupts in hw;
> 2. lp8727_intr_config() -> the function requests interrupts, so CPU
> is now able to process them;
> 3. lp8727_register_psy() -> the function allocates power supply
> objects.
>
> Now, the problem will arise if interrupt comes between "2." and
> "3.", the interrupt service routine will cause NULL dereference.
>
> So, what you really want to fix the driver is to reorder "2." and "3.",
> and on error condition call lp8727_unregister_psy().
>
I think i need to learn more in order to touch this path. will give a try.

Thanks,
> Thanks,
>
>> On Sun, 2012-07-29 at 23:31 +0545, Devendra Naga wrote:
>> > actually the driver does a request_threaded_irq and after this it calls
>> > lp8727_register_psy, and if it fails it doesn't free the irqs that it
>> > registered to
>> >
>> > Signed-off-by: Devendra Naga <develkernel412222@gmail.com>
>> > ---
>> > drivers/power/lp8727_charger.c | 4 +++-
>> > 1 file changed, 3 insertions(+), 1 deletion(-)
>> >
>> > diff --git a/drivers/power/lp8727_charger.c b/drivers/power/lp8727_charger.c
>> > index d8b7578..699f0ef 100644
>> > --- a/drivers/power/lp8727_charger.c
>> > +++ b/drivers/power/lp8727_charger.c
>> > @@ -454,11 +454,13 @@ static int lp8727_probe(struct i2c_client *cl, const struct i2c_device_id *id)
>> > ret = lp8727_register_psy(pchg);
>> > if (ret) {
>> > dev_err(pchg->dev, "power supplies register err: %d", ret);
>> > - goto error;
>> > + goto error_irq;
>> > }
>> >
>> > return 0;
>> >
>> > +error_irq:
>> > + free_irq(pchg->client->irq, pchg);
>> > error:
>> > kfree(pchg);
>> > return ret;