Commit e3db9ef6 authored by Julia Lawall's avatar Julia Lawall Committed by Jonathan Cameron

drivers/iio/industrialio-event.c: eliminate possible double free

The function __iio_add_event_config_attrs is only called once, by the
function iio_device_register_eventset.  If the call fails,
iio_device_register_eventset calls __iio_remove_event_config_attrs.  There
is thus no need for __iio_add_event_config_attrs to also call
__iio_remove_event_config_attrs on failure.

A simplified version of the semantic match that finds this problem is as
follows: (http://coccinelle.lip6.fr/)

// <smpl>
@r@
identifier f,free,a;
parameter list[n] ps;
type T;
expression e;
@@

f(ps,T a,...) {
  ... when any
      when != a = e
  if(...) { ... free(a); ... return ...; }
  ... when any
}

@@
identifier r.f,r.free;
expression x,a;
expression list[r.n] xs;
@@

* x = f(xs,a,...);
  if (...) { ... free(a); ... return ...; }
// </smpl>
Signed-off-by: default avatarJulia Lawall <Julia.Lawall@lip6.fr>
Signed-off-by: default avatarJonathan Cameron <jic23@kernel.org>
parent e8f45e33
...@@ -350,15 +350,10 @@ static inline int __iio_add_event_config_attrs(struct iio_dev *indio_dev) ...@@ -350,15 +350,10 @@ static inline int __iio_add_event_config_attrs(struct iio_dev *indio_dev)
ret = iio_device_add_event_sysfs(indio_dev, ret = iio_device_add_event_sysfs(indio_dev,
&indio_dev->channels[j]); &indio_dev->channels[j]);
if (ret < 0) if (ret < 0)
goto error_clear_attrs; return ret;
attrcount += ret; attrcount += ret;
} }
return attrcount; return attrcount;
error_clear_attrs:
__iio_remove_event_config_attrs(indio_dev);
return ret;
} }
static bool iio_check_for_dynamic_events(struct iio_dev *indio_dev) static bool iio_check_for_dynamic_events(struct iio_dev *indio_dev)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment