The code modifies rdev, but locks c_rdev instead. The bug remains: stored c_rdev could be freed just after unlock anyway. This doesn't blow up because regulator_list_mutex taken outside holds it together.
Signed-off-by: Michał Mirosław <mirq-li...@rere.qmqm.pl> --- drivers/regulator/core.c | 4 ---- 1 file changed, 4 deletions(-) diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c index b85ec974944e..f8834559a2fb 100644 --- a/drivers/regulator/core.c +++ b/drivers/regulator/core.c @@ -4942,13 +4942,9 @@ static void regulator_resolve_coupling(struct regulator_dev *rdev) return; } - regulator_lock(c_rdev); - c_desc->coupled_rdevs[i] = c_rdev; c_desc->n_resolved++; - regulator_unlock(c_rdev); - regulator_resolve_coupling(c_rdev); } } -- 2.20.1