input: error handling bug in lm8323_probe()
Subsystems (3)
PATCH 1/1 input: error handling bug in lm8323_probe()
We reuse the "i" variable later on so if we goto fail3 or fail4 then "i" will be set to the wrong thing and cause a crash.
Signed-off-by Dan Carpenter <[email protected]>
drivers/input/keyboard/lm8323.c +7 -5
@@ -642,6 +642,7 @@ static int __devinit lm8323_probe(struct i2c_client *client,struct lm8323_platform_data *pdata = client->dev.platform_data;struct input_dev *idev;struct lm8323_chip *lm; +int pwm;int i, err;unsigned long tmo;u8 data[2 ];
@@ -710,8 +711,9 @@ static int __devinit lm8323_probe(struct i2c_client *client, goto fail1; } -for (i =0 ; i <LM8323_NUM_PWMS ; i++) { - err =init_pwm (lm, i +1 , &client->dev, pdata->pwm_names[i]); +for (pwm =0 ; pwm <LM8323_NUM_PWMS ; pwm++) { + err =init_pwm (lm, pwm +1 , &client->dev, + pdata->pwm_names[pwm]);if (err <0 ) goto fail2; }
@@ -764,9 +766,9 @@ fail4: fail3:device_remove_file (&client->dev, &dev_attr_disable_kp); fail2: -while (--i >=0 ) -if (lm->pwm[i].enabled) -led_classdev_unregister (&lm->pwm[i].cdev); +while (--pwm >=0 ) +if (lm->pwm[pwm].enabled) +led_classdev_unregister (&lm->pwm[pwm].cdev); fail1:input_free_device (idev);kfree (lm);
Quoted 5 lines · Dan Carpenter
We reuse the "i" variable later on so if we goto fail3 or fail4 then "i" will be set to the wrong thing and cause a crash.
Signed-off-by Dan Carpenter <[email protected]>
Applied to next, thanks Dan.
Signature · 1 line
Dmitry