[PATCH 14/24] misc: fix dangling pointers

[Wolfram Sang]

Fix I2C-drivers which missed setting clientdata to NULL before freeing the
structure it points to. Also fix drivers which do this _after_ the structure
was freed already.

Signed-off-by: Wolfram Sang <w.sang@xxxxxxxxxxxxxx>
---

Found using coccinelle, then reviewed. Full patchset is available via
kernel-janitors, linux-i2c, and LKML.
---
 drivers/misc/ad525x_dpot.c |    2 +-
 drivers/misc/ics932s401.c  |    2 ++
 drivers/misc/isl29003.c    |    6 +++++-
 drivers/misc/tsl2550.c     |    6 +++++-
 4 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/drivers/misc/ad525x_dpot.c b/drivers/misc/ad525x_dpot.c
index 30a59f2..3b6f437 100644
--- a/drivers/misc/ad525x_dpot.c
+++ b/drivers/misc/ad525x_dpot.c
@@ -567,8 +567,8 @@ static int ad525x_probe(struct i2c_client *client,
 	return 0;
 
 exit_free:
-	kfree(data);
 	i2c_set_clientdata(client, NULL);
+	kfree(data);
 exit:
 	dev_err(dev, "failed to create client\n");
 	return err;
diff --git a/drivers/misc/ics932s401.c b/drivers/misc/ics932s401.c
index 395a4ea..f60b7e7 100644
--- a/drivers/misc/ics932s401.c
+++ b/drivers/misc/ics932s401.c
@@ -465,6 +465,7 @@ static int ics932s401_probe(struct i2c_client *client,
 	return 0;
 
 exit_free:
+	i2c_set_clientdata(client, NULL);
 	kfree(data);
 exit:
 	return err;
@@ -475,6 +476,7 @@ static int ics932s401_remove(struct i2c_client *client)
 	struct ics932s401_data *data = i2c_get_clientdata(client);
 
 	sysfs_remove_group(&client->dev.kobj, &data->attrs);
+	i2c_set_clientdata(client, NULL);
 	kfree(data);
 	return 0;
 }
diff --git a/drivers/misc/isl29003.c b/drivers/misc/isl29003.c
index a71e245..5bd4d8b 100644
--- a/drivers/misc/isl29003.c
+++ b/drivers/misc/isl29003.c
@@ -397,15 +397,19 @@ static int __devinit isl29003_probe(struct i2c_client *client,
 	return 0;
 
 exit_kfree:
+	i2c_set_clientdata(client, NULL);
 	kfree(data);
 	return err;
 }
 
 static int __devexit isl29003_remove(struct i2c_client *client)
 {
+	struct isl29003_data *data = i2c_get_clientdata(client);
+
 	sysfs_remove_group(&client->dev.kobj, &isl29003_attr_group);
 	isl29003_set_power_state(client, 0);
-	kfree(i2c_get_clientdata(client));
+	i2c_set_clientdata(client, NULL);
+	kfree(data);
 	return 0;
 }
 
diff --git a/drivers/misc/tsl2550.c b/drivers/misc/tsl2550.c
index 483ae5f..230c326 100644
--- a/drivers/misc/tsl2550.c
+++ b/drivers/misc/tsl2550.c
@@ -400,6 +400,7 @@ static int __devinit tsl2550_probe(struct i2c_client *client,
 	return 0;
 
 exit_kfree:
+	i2c_set_clientdata(client, NULL);
 	kfree(data);
 exit:
 	return err;
@@ -407,12 +408,15 @@ exit:
 
 static int __devexit tsl2550_remove(struct i2c_client *client)
 {
+	struct tsl2550_data *data = i2c_get_clientdata(client);
+
 	sysfs_remove_group(&client->dev.kobj, &tsl2550_attr_group);
 
 	/* Power down the device */
 	tsl2550_set_power_state(client, 0);
 
-	kfree(i2c_get_clientdata(client));
+	i2c_set_clientdata(client, NULL);
+	kfree(data);
 
 	return 0;
 }
-- 
1.7.0

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/