Commit 0b208e41 authored Oct 29, 2013 by Geert Uytterhoeven Committed by Lee Jones Nov 11, 2013

mfd: Fix memory leak in mfd_add_devices()



If the first call to mfd_add_device() fails, no child devices have been
registered to the parent yet, and thus mfd_remove_devices() won't find
anything to remove nor free.
Hence the previously allocated array of atomic_t objects will leak.

Free the array instead of calling mfd_remove_devices() on failure during
the first loop iteration to fix this.

Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Lee Jones <lee.jones@linaro.org>

parent 03e361b2

drivers/mfd/mfd-core.c

+8 −4

Original line number	Diff line number	Diff line
		@@ -187,7 +187,7 @@ int mfd_add_devices(struct device *parent, int id,
		int irq_base, struct irq_domain *domain)
		{
		int i;
		int ret = 0;
		int ret;
		atomic_t *cnts;

		/* initialize reference counting for all cells */
		@@ -200,12 +200,16 @@ int mfd_add_devices(struct device *parent, int id,
		ret = mfd_add_device(parent, id, cells + i, cnts + i, mem_base,
		irq_base, domain);
		if (ret)
		break;
		goto fail;
		}

		if (ret)
		mfd_remove_devices(parent);
		return 0;

		fail:
		if (i)
		mfd_remove_devices(parent);
		else
		kfree(cnts);
		return ret;
		}
		EXPORT_SYMBOL(mfd_add_devices);