renegade-project/linux-next
2
0
Fork 0
mirror of https://github.com/edk2-porting/linux-next.git synced 2024-11-18 15:44:02 +08:00
Code

generic-adc-battery: Fix forever loop in gab_remove()

Browse Source 
There is a forever loop calling iio_channel_release() because the
"chan < " part of the "chan < ARRAY_SIZE()" is missing.  This is in both
the error handling on probe and also in the remove function.

The other thing is that it's possible for some of the elements of the
adc_bat->channel[chan] array to be an ERR_PTR().  I've changed them to be
NULL instead.  We're still not allowed to pass NULLs to
iio_channel_release() so I've added a check.

Finally, I removed an unused "chan = ARRAY_SIZE(gab_chan_name);" statement
as a small cleanup.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Anton Vorontsov <anton@enomsg.org>
This commit is contained in:
Dan Carpenter 2013-02-14 10:26:43 +03:00 committed by Anton Vorontsov
parent 049645d753
commit 64d26f225f
1 changed files with 9 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
drivers/power/generic-adc-battery.c
View File

@ -263,9 +263,6 @@ static int gab_probe(struct platform_device *pdev)
psy->external_power_changed = gab_ext_power_changed;
adc_bat->pdata = pdata;
/* calculate the total number of channels */
chan = ARRAY_SIZE(gab_chan_name);
/*
* copying the static properties and allocating extra memory for holding
* the extra configurable properties received from platform data.
@ -291,6 +288,7 @@ static int gab_probe(struct platform_device *pdev)
gab_chan_name[chan]);
if (IS_ERR(adc_bat->channel[chan])) {
ret = PTR_ERR(adc_bat->channel[chan]);
adc_bat->channel[chan] = NULL;
} else {
/* copying properties for supported channels only */
memcpy(properties + sizeof(*(psy->properties)) * index,
@ -344,8 +342,10 @@ err_gpio:
gpio_req_fail:
power_supply_unregister(psy);
err_reg_fail:
for (chan = 0; ARRAY_SIZE(gab_chan_name); chan++)
iio_channel_release(adc_bat->channel[chan]);
for (chan = 0; chan < ARRAY_SIZE(gab_chan_name); chan++) {
if (adc_bat->channel[chan])
iio_channel_release(adc_bat->channel[chan]);
}
second_mem_fail:
kfree(psy->properties);
first_mem_fail:
@ -365,8 +365,10 @@ static int gab_remove(struct platform_device *pdev)
gpio_free(pdata->gpio_charge_finished);
}
for (chan = 0; ARRAY_SIZE(gab_chan_name); chan++)
iio_channel_release(adc_bat->channel[chan]);
for (chan = 0; chan < ARRAY_SIZE(gab_chan_name); chan++) {
if (adc_bat->channel[chan])
iio_channel_release(adc_bat->channel[chan]);
}
kfree(adc_bat->psy.properties);
cancel_delayed_work(&adc_bat->bat_work);