From b4d4b1f087b9d4d730eb70f24032395d7cd7e591 Mon Sep 17 00:00:00 2001 From: Axel Lin Date: Wed, 21 Nov 2012 14:33:56 +0800 Subject: gpiolib: Fix use after free in gpiochip_add_pin_range This is introduced by commit 9ab6e988 "gpiolib: return any error code from range creation". Signed-off-by: Axel Lin Signed-off-by: Linus Walleij --- drivers/gpio/gpiolib.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'drivers/gpio/gpiolib.c') diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c index 26e27c1fecb1..58b9838801c0 100644 --- a/drivers/gpio/gpiolib.c +++ b/drivers/gpio/gpiolib.c @@ -1201,6 +1201,7 @@ int gpiochip_add_pin_range(struct gpio_chip *chip, const char *pinctl_name, unsigned int npins) { struct gpio_pin_range *pin_range; + int ret; pin_range = kzalloc(sizeof(*pin_range), GFP_KERNEL); if (!pin_range) { @@ -1219,10 +1220,11 @@ int gpiochip_add_pin_range(struct gpio_chip *chip, const char *pinctl_name, pin_range->pctldev = pinctrl_find_and_add_gpio_range(pinctl_name, &pin_range->range); if (IS_ERR(pin_range->pctldev)) { + ret = PTR_ERR(pin_range->pctldev); pr_err("%s: GPIO chip: could not create pin range\n", chip->label); kfree(pin_range); - return PTR_ERR(pin_range->pctldev); + return ret; } pr_debug("GPIO chip %s: created GPIO range %d->%d ==> %s PIN %d->%d\n", chip->label, gpio_offset, gpio_offset + npins - 1, -- cgit v1.2.3