From 64d26f225fefe06c870634e7bfe026a063e7f776 Mon Sep 17 00:00:00 2001 From: Dan Carpenter Date: Thu, 14 Feb 2013 10:26:43 +0300 Subject: generic-adc-battery: Fix forever loop in gab_remove() There is a forever loop calling iio_channel_release() because the "chan < " part of the "chan < ARRAY_SIZE()" is missing. This is in both the error handling on probe and also in the remove function. The other thing is that it's possible for some of the elements of the adc_bat->channel[chan] array to be an ERR_PTR(). I've changed them to be NULL instead. We're still not allowed to pass NULLs to iio_channel_release() so I've added a check. Finally, I removed an unused "chan = ARRAY_SIZE(gab_chan_name);" statement as a small cleanup. Signed-off-by: Dan Carpenter Signed-off-by: Anton Vorontsov --- drivers/power/generic-adc-battery.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) (limited to 'drivers/power') diff --git a/drivers/power/generic-adc-battery.c b/drivers/power/generic-adc-battery.c index 32ce17e235c..836816b82cb 100644 --- a/drivers/power/generic-adc-battery.c +++ b/drivers/power/generic-adc-battery.c @@ -263,9 +263,6 @@ static int gab_probe(struct platform_device *pdev) psy->external_power_changed = gab_ext_power_changed; adc_bat->pdata = pdata; - /* calculate the total number of channels */ - chan = ARRAY_SIZE(gab_chan_name); - /* * copying the static properties and allocating extra memory for holding * the extra configurable properties received from platform data. @@ -291,6 +288,7 @@ static int gab_probe(struct platform_device *pdev) gab_chan_name[chan]); if (IS_ERR(adc_bat->channel[chan])) { ret = PTR_ERR(adc_bat->channel[chan]); + adc_bat->channel[chan] = NULL; } else { /* copying properties for supported channels only */ memcpy(properties + sizeof(*(psy->properties)) * index, @@ -344,8 +342,10 @@ err_gpio: gpio_req_fail: power_supply_unregister(psy); err_reg_fail: - for (chan = 0; ARRAY_SIZE(gab_chan_name); chan++) - iio_channel_release(adc_bat->channel[chan]); + for (chan = 0; chan < ARRAY_SIZE(gab_chan_name); chan++) { + if (adc_bat->channel[chan]) + iio_channel_release(adc_bat->channel[chan]); + } second_mem_fail: kfree(psy->properties); first_mem_fail: @@ -365,8 +365,10 @@ static int gab_remove(struct platform_device *pdev) gpio_free(pdata->gpio_charge_finished); } - for (chan = 0; ARRAY_SIZE(gab_chan_name); chan++) - iio_channel_release(adc_bat->channel[chan]); + for (chan = 0; chan < ARRAY_SIZE(gab_chan_name); chan++) { + if (adc_bat->channel[chan]) + iio_channel_release(adc_bat->channel[chan]); + } kfree(adc_bat->psy.properties); cancel_delayed_work(&adc_bat->bat_work); -- cgit v1.2.3-18-g5258