drivers/staging/iio/iio_input.c:189 iio_input_probe() error: don't call input_free_device(

Hi Jonathan,

There is a smatch warning in tree

git://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio.git wip

+ drivers/staging/iio/iio_input.c:189 iio_input_probe() error: don't call input_free_device() after input_unregister_device()

vim +189 drivers/staging/iio/iio_input.c

186 error_unregister_input:
187 input_unregister_device(st->idev);
188 error_free_idev:

190 error_channels_release_all:
191 iio_channel_release_all_cb(st->buff);
192 error_free_state:
193 kfree(st);
194 return ret;
195 }

---
0-DAY kernel build testing backend Open Source Technology Centre
Fengguang Wu, Yuanhan Liu Intel Corporation

In this case, it's obvious that we do reference "st->idev" after calling input_unregister_device() so this is a bug. Normally way people write this is to make input_register_device() the last call in the probe() function which can fail. In this case, it's a bit awkward to do that it looks like.

Anyway, it's a double free bug because input_register/unregister_device() is ref counted.

regards,
dan carpenter