From c75793d8ab743acdd07120cf11c0242daea8f780 Mon Sep 17 00:00:00 2001 From: Krzysztof Kozlowski Date: Thu, 6 Mar 2014 10:31:15 +0100 Subject: gpio: max732x: Fix I2C dummy device resource leak on probe failure In max732x_probe() driver allocates dummy I2C device (if number of ports is greater than 8) however it is not unregistered if probe fails later. Fix the leak by unregistering dummy I2C device if it was allocated. Signed-off-by: Krzysztof Kozlowski Signed-off-by: Linus Walleij --- drivers/gpio/gpio-max732x.c | 2 ++ 1 file changed, 2 insertions(+) (limited to 'drivers/gpio/gpio-max732x.c') diff --git a/drivers/gpio/gpio-max732x.c b/drivers/gpio/gpio-max732x.c index 36cb290764b..74432daaf65 100644 --- a/drivers/gpio/gpio-max732x.c +++ b/drivers/gpio/gpio-max732x.c @@ -647,6 +647,8 @@ static int max732x_probe(struct i2c_client *client, return 0; out_failed: + if (chip->client_dummy) + i2c_unregister_device(chip->client_dummy); max732x_irq_teardown(chip); return ret; } -- cgit v1.2.3-70-g09d2 From f561b4230cec90137baeba1b1c9302461939b870 Mon Sep 17 00:00:00 2001 From: Krzysztof Kozlowski Date: Thu, 6 Mar 2014 10:31:16 +0100 Subject: gpio: max732x: Fix possible NULL pointer dereference on i2c_new_dummy error In max732x_probe() driver allocates dummy I2C device (if number of ports is greater than 8) with i2c_new_dummy() but it does not check the return value of this call. In case of error (i2c_new_device(): memory allocation failure or I2C address cannot be used) this function returns NULL which is later dereferenced by i2c_smbus_read_byte() (called from max732x_readb()). Signed-off-by: Krzysztof Kozlowski Signed-off-by: Linus Walleij --- drivers/gpio/gpio-max732x.c | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'drivers/gpio/gpio-max732x.c') diff --git a/drivers/gpio/gpio-max732x.c b/drivers/gpio/gpio-max732x.c index 74432daaf65..7c36f2b0983 100644 --- a/drivers/gpio/gpio-max732x.c +++ b/drivers/gpio/gpio-max732x.c @@ -622,6 +622,13 @@ static int max732x_probe(struct i2c_client *client, goto out_failed; } + if (nr_port > 8 && !chip->client_dummy) { + dev_err(&client->dev, + "Failed to allocate second group I2C device\n"); + ret = -ENODEV; + goto out_failed; + } + mutex_init(&chip->lock); max732x_readb(chip, is_group_a(chip, 0), &chip->reg_out[0]); -- cgit v1.2.3-70-g09d2