media: stv090x: Implement probe/remove for stv090x

Hello Tobias Klausmann,

The patch eb5005df886b: "media: stv090x: Implement probe/remove for stv090x" from May 29, 2019, leads to the following static checker warning:

	drivers/media/dvb-frontends/stv090x.c:5032 stv090x_probe()
	warn: 'state' was already freed.

drivers/media/dvb-frontends/stv090x.c
4994 static int stv090x_probe(struct i2c_client *client,
4995 const struct i2c_device_id *id)
4996 {
4997 int ret = 0;
4998 struct stv090x_config *config = client->dev.platform_data;
4999
5000 struct stv090x_state *state = NULL;
5001
5002 state = kzalloc(sizeof(*state), GFP_KERNEL);
5003 if (!state) {
5004 ret = -ENOMEM;
5005 goto error;
5006 }
5007

  5008          state->verbose                          = &verbose;
  5009          state->config                           = config;
  5010          state->i2c                              = client->adapter;
  5011          state->frontend.ops                     = stv090x_ops;
  5012          state->frontend.demodulator_priv        = state;
  5013          state->demod                            = config->demod;
  5014                                                  /* Single or Dual mode */
  5015          state->demod_mode                       = config->demod_mode;
  5016          state->device                           = config->device;
  5017                                                  /* default */
  5018          state->rolloff                          = STV090x_RO_35;

5019
5020 ret = stv090x_setup_compound(state);
5021 if (ret)
5022 goto error;

stv090x_setup_compound() frees "state" on error.

5023
5024 i2c_set_clientdata(client, state);
5025
5026 /* setup callbacks */
5027 config->get_dvb_frontend = stv090x_get_dvb_frontend;
5028
5029 return 0;
5030
5031 error:

  5032          kfree(state);
                ^^^^^^^^^^^^

Double free.

5033 return ret;
5034 }

regards,
dan carpenter

Hello Dan,

yes you are right! Yet this was already reported to the Mailinglist and a patch was provided [1], which will hopefully be pushed to linux-media git repository.

[1]https://patchwork.linuxtv.org/patch/56811/

Never the less, thanks for the bugreport!

Tobias

Am 18.06.19 um 12:53 schrieb Dan Carpenter: