summaryrefslogtreecommitdiffstats
path: root/drivers/rtc/class.c
diff options
context:
space:
mode:
authorDmitry Torokhov <dmitry.torokhov@gmail.com>2015-07-20 16:02:49 -0700
committerAlexandre Belloni <alexandre.belloni@free-electrons.com>2015-09-05 13:19:07 +0200
commit6706664d92ea841913d5fcfd06c290fbe6d33bd2 (patch)
tree45a19f8e664116a18607dc69b0c48ba691ba6060 /drivers/rtc/class.c
parentdfe6c04aa289de06df95d888719af63d1d4c982d (diff)
downloadop-kernel-dev-6706664d92ea841913d5fcfd06c290fbe6d33bd2.zip
op-kernel-dev-6706664d92ea841913d5fcfd06c290fbe6d33bd2.tar.gz
rtc: class: fix double free in rtc_register_device() error path
Commit 59cca865f21e ("drivers/rtc/class.c: fix device_register() error handling") correctly noted that naked kfree() should not be used after failed device_register() call, however, while it added the needed put_device() it forgot to remove the original kfree() causing double-free. Cc: Vasiliy Kulikov <segooon@gmail.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Reviewed-by: Krzysztof Kozlowski <k.kozlowski@samsung.com> Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
Diffstat (limited to 'drivers/rtc/class.c')
-rw-r--r--drivers/rtc/class.c6
1 files changed, 2 insertions, 4 deletions
diff --git a/drivers/rtc/class.c b/drivers/rtc/class.c
index ea2a315..eb82ec2 100644
--- a/drivers/rtc/class.c
+++ b/drivers/rtc/class.c
@@ -234,8 +234,9 @@ struct rtc_device *rtc_device_register(const char *name, struct device *dev,
err = device_register(&rtc->dev);
if (err) {
+ /* This will free both memory and the ID */
put_device(&rtc->dev);
- goto exit_kfree;
+ goto exit;
}
rtc_dev_add_device(rtc);
@@ -247,9 +248,6 @@ struct rtc_device *rtc_device_register(const char *name, struct device *dev,
return rtc;
-exit_kfree:
- kfree(rtc);
-
exit_ida:
ida_simple_remove(&rtc_ida, id);
OpenPOWER on IntegriCloud