提交 969f07b4 编写于 作者: J Josh Cartwright 提交者: Linus Walleij

gpio: use kzalloc to allocate gpio_device

The use of kmalloc() to allocate the gpio_device leaves the contained struct
device object in an unknown state.  Calling dev_set_name() on a struct device
of unknown state can trigger the free() of an invalid pointer, as seen in the
following backtrace (collected by Tony Lindgren):

  kfree
  kobject_set_name_vargs
  dev_set_name
  gpiochip_add_data
  omap_gpio_probe
  platform_drv_probe
  ...
Reported-by: NGeert Uytterhoeven <geert+renesas@glider.be>
Reported-by: NMichael Welling <mwelling@ieee.org>
Reported-by: NTony Lindgren <tony@atomide.com>
Tested-by: NMichael Welling <mwelling@ieee.org>
Tested-by: NTony Lindgren <tony@atomide.com>
Signed-off-by: NJosh Cartwright <joshc@ni.com>
Signed-off-by: NLinus Walleij <linus.walleij@linaro.org>
上级 aaf2b3af
......@@ -435,7 +435,7 @@ int gpiochip_add_data(struct gpio_chip *chip, void *data)
* First: allocate and populate the internal stat container, and
* set up the struct device.
*/
gdev = kmalloc(sizeof(*gdev), GFP_KERNEL);
gdev = kzalloc(sizeof(*gdev), GFP_KERNEL);
if (!gdev)
return -ENOMEM;
gdev->dev.bus = &gpio_bus_type;
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册