bug in udev-remove.c

diff -Nru a/udev-remove.c b/udev-remove.c
@@ -119,18 +119,21 @@
 int udev_remove_device(char *path, char *subsystem)
 {
 	struct udevice *dev;
-	struct udevice device;
 	char *temp;
+	int retval;
 
-	dev = udevdb_get_dev(path);
-	if (dev == NULL) {
+	dev = malloc(sizeof(*dev));
+	if (dev == NULL)
+		return -ENOMEM;
+	memset(dev, 0, sizeof(*dev));
+
+	retval = udevdb_get_dev(path, dev);
+	if (retval) {
 		dbg("'%s' not found in database, falling back on default name", path);
 		temp = strrchr(path, '/');
 		if (temp == NULL)
 			return -ENODEV;
-		memset(&device, 0, sizeof(device));
-		dev = &device;
-		strncpy(device.name, &temp[1], sizeof(device.name));
+		strncpy(dev->name, &temp[1], sizeof(dev->name));
 	}
 
 	dbg("name is '%s'", dev->name);

@@ -138,5 +141,7 @@
 
 	sysbus_send_remove(dev->name, path);
 
-	return delete_node(dev);
+	retval = delete_node(dev);
+	free(dev);
+	return retval;
 }

diff -Nru a/udevdb.c b/udevdb.c
@@ -62,29 +62,22 @@
 	return tdb_store(udevdb, key, data, TDB_REPLACE); 
 }
 
-struct udevice *udevdb_get_dev(const char *path)
+int udevdb_get_dev(const char *path, struct udevice *dev)
 {
 	TDB_DATA key, data;
-	struct udevice *dev;
 
 	if (path == NULL)
-		return NULL;
+		return -ENODEV;
 
 	key.dptr = (void *)path;
 	key.dsize = strlen(path) + 1;
 
 	data = tdb_fetch(udevdb, key);
 	if (data.dptr == NULL || data.dsize == 0)
-		return NULL;
-
-	dev = malloc(sizeof(*dev));
-	if (dev == NULL)
-		goto exit;
+		return -ENODEV;
 
 	memcpy(dev, data.dptr, sizeof(*dev));
-exit:
-	free(data.dptr);
-	return dev;
+	return 0;
 }
 
 int udevdb_delete_dev(const char *path)

diff -Nru a/udevdb.h b/udevdb.h
@@ -13,7 +13,7 @@
 extern int udevdb_init(int init_flag);
 
 extern int udevdb_add_dev(const char *path, const struct udevice *dev);
-extern struct udevice *udevdb_get_dev(const char *path);
+extern int udevdb_get_dev(const char *path, struct udevice *dev);
 extern int udevdb_delete_dev(const char *path);
 
 #endif /* _UDEVDB_H_ */