From 0b208e41acf34c133a55a57189af30aa7924e0c6 Mon Sep 17 00:00:00 2001 From: Geert Uytterhoeven Date: Tue, 29 Oct 2013 15:47:22 +0100 Subject: mfd: Fix memory leak in mfd_add_devices() If the first call to mfd_add_device() fails, no child devices have been registered to the parent yet, and thus mfd_remove_devices() won't find anything to remove nor free. Hence the previously allocated array of atomic_t objects will leak. Free the array instead of calling mfd_remove_devices() on failure during the first loop iteration to fix this. Signed-off-by: Geert Uytterhoeven Signed-off-by: Lee Jones --- drivers/mfd/mfd-core.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) (limited to 'drivers/mfd') diff --git a/drivers/mfd/mfd-core.c b/drivers/mfd/mfd-core.c index 8736f4539bc0..968775da638a 100644 --- a/drivers/mfd/mfd-core.c +++ b/drivers/mfd/mfd-core.c @@ -187,7 +187,7 @@ int mfd_add_devices(struct device *parent, int id, int irq_base, struct irq_domain *domain) { int i; - int ret = 0; + int ret; atomic_t *cnts; /* initialize reference counting for all cells */ @@ -200,12 +200,16 @@ int mfd_add_devices(struct device *parent, int id, ret = mfd_add_device(parent, id, cells + i, cnts + i, mem_base, irq_base, domain); if (ret) - break; + goto fail; } - if (ret) - mfd_remove_devices(parent); + return 0; +fail: + if (i) + mfd_remove_devices(parent); + else + kfree(cnts); return ret; } EXPORT_SYMBOL(mfd_add_devices); -- cgit v1.2.3