dev_pm_put_subsys_data() calls kfree() while holding device power lock, when the reference count is 0. Fix it to call kfree() after releasing the lock.
Signed-off-by: Shuah Khan <[email protected]> Reviewed-by: Pavel Machek <[email protected]> Reviewed-by: Rafael Wysocki <[email protected]> --- drivers/base/power/common.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/drivers/base/power/common.c b/drivers/base/power/common.c index 39c3252..e5b99f7 100644 --- a/drivers/base/power/common.c +++ b/drivers/base/power/common.c @@ -61,24 +61,26 @@ EXPORT_SYMBOL_GPL(dev_pm_get_subsys_data); int dev_pm_put_subsys_data(struct device *dev) { struct pm_subsys_data *psd; - int ret = 0; + int ret = 1; spin_lock_irq(&dev->power.lock); psd = dev_to_psd(dev); if (!psd) { - ret = -EINVAL; goto out; } if (--psd->refcount == 0) { dev->power.subsys_data = NULL; - kfree(psd); ret = 1; + } else { + psd = NULL; + ret = 0; } out: spin_unlock_irq(&dev->power.lock); + kfree(psd); return ret; } -- 1.7.10.4 N�����r��y����b�X��ǧv�^�){.n�+����{����zX����ܨ}���Ơz�&j:+v�������zZ+��+zf���h���~����i���z� �w���?�����&�)ߢf��^jǫy�m��@A�a��� 0��h���i
