iio: core: Fix double free.
When an error occurred during event registration memory was freed twice
resulting in kernel memory corruption and a crash in unrelated code.
The problem was caused by
iio_device_unregister_eventset()
iio_device_unregister_sysfs()
being called twice, once on the error path and then
again via iio_dev_release().
Fix this by making these two functions idempotent so they
may be called multiple times.
The problem was observed before applying
78b33216
iio:core: Handle error when mask type is not separate
Signed-off-by: Martin Fuzzey <mfuzzey@parkeon.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
This commit is contained in:

committed by
Jonathan Cameron

parent
af5e1a6831
commit
c1b03ab5e8
@@ -500,6 +500,7 @@ int iio_device_register_eventset(struct iio_dev *indio_dev)
|
||||
error_free_setup_event_lines:
|
||||
iio_free_chan_devattr_list(&indio_dev->event_interface->dev_attr_list);
|
||||
kfree(indio_dev->event_interface);
|
||||
indio_dev->event_interface = NULL;
|
||||
return ret;
|
||||
}
|
||||
|
||||
|
Reference in New Issue
Block a user