Skip to content

Commit 5d92f71

Browse files
AxelLingregkh
authored andcommitted
Staging: android: timed_gpio: Fix resource leak in timed_gpio_probe error paths
If gpio_request fails, we need to free all allocated resources. Current code uses wrong array index to access gpio_data array. So current code actually frees gpio_data[i].gpio by j times. This patch moves the error handling code to err_out and thus improves readability. Signed-off-by: Axel Lin <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
1 parent 099f5d0 commit 5d92f71

File tree

1 file changed

+15
-12
lines changed

1 file changed

+15
-12
lines changed

drivers/staging/android/timed_gpio.c

Lines changed: 15 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -85,7 +85,7 @@ static int timed_gpio_probe(struct platform_device *pdev)
8585
struct timed_gpio_platform_data *pdata = pdev->dev.platform_data;
8686
struct timed_gpio *cur_gpio;
8787
struct timed_gpio_data *gpio_data, *gpio_dat;
88-
int i, j, ret = 0;
88+
int i, ret;
8989

9090
if (!pdata)
9191
return -EBUSY;
@@ -108,18 +108,12 @@ static int timed_gpio_probe(struct platform_device *pdev)
108108
gpio_dat->dev.get_time = gpio_get_time;
109109
gpio_dat->dev.enable = gpio_enable;
110110
ret = gpio_request(cur_gpio->gpio, cur_gpio->name);
111-
if (ret >= 0) {
112-
ret = timed_output_dev_register(&gpio_dat->dev);
113-
if (ret < 0)
114-
gpio_free(cur_gpio->gpio);
115-
}
111+
if (ret < 0)
112+
goto err_out;
113+
ret = timed_output_dev_register(&gpio_dat->dev);
116114
if (ret < 0) {
117-
for (j = 0; j < i; j++) {
118-
timed_output_dev_unregister(&gpio_data[i].dev);
119-
gpio_free(gpio_data[i].gpio);
120-
}
121-
kfree(gpio_data);
122-
return ret;
115+
gpio_free(cur_gpio->gpio);
116+
goto err_out;
123117
}
124118

125119
gpio_dat->gpio = cur_gpio->gpio;
@@ -131,6 +125,15 @@ static int timed_gpio_probe(struct platform_device *pdev)
131125
platform_set_drvdata(pdev, gpio_data);
132126

133127
return 0;
128+
129+
err_out:
130+
while (--i >= 0) {
131+
timed_output_dev_unregister(&gpio_data[i].dev);
132+
gpio_free(gpio_data[i].gpio);
133+
}
134+
kfree(gpio_data);
135+
136+
return ret;
134137
}
135138

136139
static int timed_gpio_remove(struct platform_device *pdev)

0 commit comments

Comments
 (0)