If krealloc() fails there's no way of freeing the memory previously allocated for pctl->functions as it is overwritten by krealloc()'s return value. Fix this by assigning the return value to a temporary variable first so we can do error handling (which we didn't do at all before).
Signed-off-by: Johannes Thumshirn <[email protected]> --- drivers/pinctrl/sunxi/pinctrl-sunxi.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/drivers/pinctrl/sunxi/pinctrl-sunxi.c b/drivers/pinctrl/sunxi/pinctrl-sunxi.c index 54455af..57dd09b 100644 --- a/drivers/pinctrl/sunxi/pinctrl-sunxi.c +++ b/drivers/pinctrl/sunxi/pinctrl-sunxi.c @@ -787,6 +787,7 @@ static int sunxi_pinctrl_add_function(struct sunxi_pinctrl *pctl, static int sunxi_pinctrl_build_state(struct platform_device *pdev) { struct sunxi_pinctrl *pctl = platform_get_drvdata(pdev); + struct sunxi_pinctrl_function *functions; int i; pctl->ngroups = pctl->desc->npins; @@ -833,9 +834,14 @@ static int sunxi_pinctrl_build_state(struct platform_device *pdev) } } - pctl->functions = krealloc(pctl->functions, - pctl->nfunctions * sizeof(*pctl->functions), - GFP_KERNEL); + functions = krealloc(pctl->functions, + pctl->nfunctions * sizeof(*pctl->functions), + GFP_KERNEL); + if (!functions) { + kfree(pctl->functions); + return -ENOMEM; + } + pctl->functions = functions; for (i = 0; i < pctl->desc->npins; i++) { const struct sunxi_desc_pin *pin = pctl->desc->pins + i; -- 1.8.5.6
