tsl2563 probe function has two minor issues with it's error handling paths:
1) it is silent (did not report errors to dmesg)
2) did not return failure code (mixed up use of ret and err)
and two major issues:
3) goto fail2 would corrupt a free memory pool ("double free")
4) device registration failure did NOT cancel/flush delayed work.
(and thus dereference a freed data structure later)
The "double free" is subtle and was introduced with this change:
Author: Jonathan Cameron <jic23@cam.ac.uk>
Date: Mon Apr 18 12:58:55 2011 +0100
staging:iio:tsl2563 take advantage of new iio_device_allocate private data.
Originally, chip was allocated seperately. Now it's appended to the
indio_dev by iio_allocate_device(sizeof(*chip)). So we only need one
kfree call as well (in iio_free_device()).
Gory details of tracking this down are here:
http://crosbug.com/26819
Despite iio_device_registration failing, system can at least now boot.
Will follow up with a fix to "double register : in_intensity_both_raw"
error that is included in the bug report.
Signed-off-by: Grant Grundler <grundler@chromium.org>
Acked-by: Jonathan Cameron <jic23@kernel.org>
Reviewed-by: Bryan Freed <bfreed@chromium.org>
Reviewed-by: Benson Leung <bleung@chromium.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
dbf717fd9a