Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0e03fd3e authored by Alexey Khoroshilov's avatar Alexey Khoroshilov Committed by David S. Miller
Browse files

pxa168: fix double deallocation of managed resources 



Commit 43d3ddf8 ("net: pxa168_eth: add device tree support") starts
to use managed resources by adding devm_clk_get() and
devm_ioremap_resource(), but it leaves explicit iounmap() and clock_put()
in pxa168_eth_remove() and in failure handling code of pxa168_eth_probe().
As a result double free can happen.

The patch removes explicit resource deallocation. Also it converts
clk_disable() to clk_disable_unprepare() to make it symmetrical with
clk_prepare_enable().

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: default avatarAlexey Khoroshilov <khoroshilov@ispras.ru>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 2ea2f62c

drivers/net/ethernet/marvell/pxa168_eth.c

+5 −11
Original line number Original line Diff line number Diff line
@@ -1508,7 +1508,8 @@ static int pxa168_eth_probe(struct platform_device *pdev) 
		np = of_parse_phandle(pdev->dev.of_node, "phy-handle", 0);

		np = of_parse_phandle(pdev->dev.of_node, "phy-handle", 0);

		if (!np) {

		if (!np) {

			dev_err(&pdev->dev, "missing phy-handle\n");

			dev_err(&pdev->dev, "missing phy-handle\n");

			return -EINVAL;

			err = -EINVAL;

			goto err_netdev;

		}

		}

		of_property_read_u32(np, "reg", &pep->phy_addr);

		of_property_read_u32(np, "reg", &pep->phy_addr);

		pep->phy_intf = of_get_phy_mode(pdev->dev.of_node);

		pep->phy_intf = of_get_phy_mode(pdev->dev.of_node);
@@ -1526,7 +1527,7 @@ static int pxa168_eth_probe(struct platform_device *pdev) 
	pep->smi_bus = mdiobus_alloc();

	pep->smi_bus = mdiobus_alloc();

	if (pep->smi_bus == NULL) {

	if (pep->smi_bus == NULL) {

		err = -ENOMEM;

		err = -ENOMEM;

		goto err_base;

		goto err_netdev;

	}

	}

	pep->smi_bus->priv = pep;

	pep->smi_bus->priv = pep;

	pep->smi_bus->name = "pxa168_eth smi";

	pep->smi_bus->name = "pxa168_eth smi";
@@ -1551,13 +1552,10 @@ static int pxa168_eth_probe(struct platform_device *pdev) 
	mdiobus_unregister(pep->smi_bus);

	mdiobus_unregister(pep->smi_bus);

err_free_mdio:

err_free_mdio:

	mdiobus_free(pep->smi_bus);

	mdiobus_free(pep->smi_bus);

err_base:

	iounmap(pep->base);

err_netdev:

err_netdev:

	free_netdev(dev);

	free_netdev(dev);

err_clk:

err_clk:

	clk_disable(clk);

	clk_disable_unprepare(clk);

	clk_put(clk);

	return err;

	return err;

}

}
@@ -1574,13 +1572,9 @@ static int pxa168_eth_remove(struct platform_device *pdev) 
	if (pep->phy)

	if (pep->phy)

		phy_disconnect(pep->phy);

		phy_disconnect(pep->phy);

	if (pep->clk) {

	if (pep->clk) {

		clk_disable(pep->clk);

		clk_disable_unprepare(pep->clk);

		clk_put(pep->clk);

		pep->clk = NULL;

	}

	}





	iounmap(pep->base);

	pep->base = NULL;

	mdiobus_unregister(pep->smi_bus);

	mdiobus_unregister(pep->smi_bus);

	mdiobus_free(pep->smi_bus);

	mdiobus_free(pep->smi_bus);

	unregister_netdev(dev);

	unregister_netdev(dev);