On Thu, Dec 26, 2013 at 09:00:14AM +0200, Baruch Siach wrote:

> @@ -669,6 +671,11 @@ static int dw_spi_setup(struct spi_device *spi)
>  
>       spi_set_ctldata(spi, chip);
>       return 0;
> +
> +err_kfree:
> +     kfree(chip);
> +
> +     return ret;
>  }

A better fix would be to convert to devm_kzalloc() so there is no
possibility of paths that don't free (and move the ctldata set earlier
so we don't forget about it on creation).

Indeed this patch will introduce a bug - on the second call to this
function if we hit an error then the struct will be freed but ctldata
won't be cleared.  This will mean that if there is a further call then
ctldata will still point at the old struct and the function will try to
use it rather than allocating a new one.

Attachment: signature.asc
Description: Digital signature

Reply via email to