We should decrement "i" before doing the free_irq(). If we call this
because request_threaded_irq() failed then we don't want to free the
thing which failed. Or in the case where we get here because
power_supply_register() failed then the original codes does a read past
the end of the array.
Signed-off-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
diff --git a/drivers/power/da9052-battery.c b/drivers/power/da9052-battery.c
index 20b86ed..d9d034d 100644
--- a/drivers/power/da9052-battery.c
+++ b/drivers/power/da9052-battery.c
@@ -623,7 +623,7 @@ static s32 __devinit da9052_bat_probe(struct platform_device *pdev)
return 0;
err:
- for (; i >= 0; i--) {
+ while (--i >= 0) {
irq = platform_get_irq_byname(pdev, da9052_bat_irqs[i]);
free_irq(bat->da9052->irq_base + irq, bat);
}
--
To unsubscribe from this list: send the line "unsubscribe kernel-janitors" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
