summaryrefslogtreecommitdiffstats
path: root/drivers/hwmon/hwmon.c
diff options
context:
space:
mode:
authorGuenter Roeck <linux@roeck-us.net>2019-06-06 18:43:14 +0200
committerGuenter Roeck <linux@roeck-us.net>2019-06-24 03:33:01 +0200
commit792eac1843196708e6f72e73b8f50e273721757e (patch)
tree0ccbf2269de10386055fa87e67a7a9b43405c07a /drivers/hwmon/hwmon.c
parenthwmon: (smsc47m1) fix (suspicious) outside array bounds warnings (diff)
downloadlinux-792eac1843196708e6f72e73b8f50e273721757e.tar.xz
linux-792eac1843196708e6f72e73b8f50e273721757e.zip
hwmon: (core) Add comment describing how hwdev is freed in error path
The hwmon core registers the hwmon device before adding sensors to the thermal core. If that fails, the hwmon device is released and an error is returned to the caller. From the code flow, it appears to be necessary to free struct hwmon_device *, allocated with kzalloc(), in that situation. This is incorrect, since the data structure will be freed automatically in hwmon_dev_release() when device_unregister() is called. This used to result in a double free, which was found and fixed with commit 74e3512731bd ("hwmon: (core) Fix double-free in __hwmon_device_register()"). This is, however, not obvious; any reader may erroneously conclude that the data structure is not freed. Add comment explaining why kfree() is not necessary in this situation. Reported-by: Eduardo Valentin <eduval@amazon.com> Cc: Eduardo Valentin <eduval@amazon.com> Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Diffstat (limited to 'drivers/hwmon/hwmon.c')
-rw-r--r--drivers/hwmon/hwmon.c6
1 files changed, 6 insertions, 0 deletions
diff --git a/drivers/hwmon/hwmon.c b/drivers/hwmon/hwmon.c
index 05e120e01cb4..1f3b30b085b9 100644
--- a/drivers/hwmon/hwmon.c
+++ b/drivers/hwmon/hwmon.c
@@ -651,6 +651,12 @@ __hwmon_device_register(struct device *dev, const char *name, void *drvdata,
hwdev, j);
if (err) {
device_unregister(hdev);
+ /*
+ * Don't worry about hwdev;
+ * hwmon_dev_release(), called
+ * from device_unregister(),
+ * will free it.
+ */
goto ida_remove;
}
}