Skip to contentSkip to conversation

misc: Fix irq leak in max8997_muic_probe error path

PATCH RESEND In review Axel Lin 2 participants 2 messages Mar 26, 2012 Char and misc drivers

lore
Share & tools
lore

Axel Lin

author
#0 lore raw

PATCH RESEND 1/1 misc: Fix irq leak in max8997_muic_probe error path

Current code does not properly free allocated irqs if request_threaded_irq returns error, fix it.

---
This patch was sent on LKML:https://lkml.org/lkml/2011/12/17/114 This resend re-generate the patch because it does not apply due to the change in commit 71e5878 "misc: Remove max8997-muic sysfs attributes".

 drivers/misc/max8997-muic.c |    6 ++----
 1 files changed, 2 insertions(+), 4 deletions(-)
drivers/misc/max8997-muic.c +2 -4
index 19591ea..2e7df9c 100644
@@ -440,10 +440,6 @@ static int __devinit max8997_muic_probe(struct platform_device *pdev)
 				"failed: irq request (IRQ: %d,"
 				" error :%d)\n",
 				muic_irq->irq, ret);
-
-			for (i = i - 1; i >= 0; i--)
-				free_irq(muic_irq->irq, info);
-
 			goto err_irq;
 		}
 	}
@@ -457,6 +453,8 @@ static int __devinit max8997_muic_probe(struct platform_device *pdev)
 	return ret;
 
 err_irq:
+	while (--i >= 0)
+		free_irq(pdata->irq_base + muic_irqs[i].irq, info);
 err_pdata:
 	kfree(info);
 err_kfree:
Signature · 1 line
1.7.5.4
maintainer Acked-by on v1 1/1
#1 lore raw
Quoted 6 lines · Axel Lin

Current code does not properly free allocated irqs if request_threaded_irq returns error, fix it.

It took me a while to see why this is correct.

Note: It would be nicer to move the dev_err() down into the error path as well and also fix the message to print the correct irq number, but your patch is the important part.

Note to the driver maintainers: It looks like there is a race in the max8997_muic_irq_handler() function assigning the info->irq member when multiple interrupts come in at the same time. Also, calling sched_work from a threaded interrupt handler is pointless. I would suggest fixing both of these by removing the work function and calling moving its contents into the interrupt handler directly. Please correct me if I am missing somehting here.

Arnd