Hello Dan,
yes you are right! Yet this was already reported to the Mailinglist and
a patch was provided [1], which will hopefully be pushed to linux-media
git repository.
[1]https://patchwork.linuxtv.org/patch/56811/
Never the less, thanks for the bugreport!
Tobias
Am 18.06.19 um 12:53 schrieb Dan Carpenter:
Hello Tobias Klausmann,
The patch eb5005df886b: "media: stv090x: Implement probe/remove for
stv090x" from May 29, 2019, leads to the following static checker
warning:
drivers/media/dvb-frontends/stv090x.c:5032 stv090x_probe()
warn: 'state' was already freed.
drivers/media/dvb-frontends/stv090x.c
4994 static int stv090x_probe(struct i2c_client *client,
4995 const struct i2c_device_id *id)
4996 {
4997 int ret = 0;
4998 struct stv090x_config *config = client->dev.platform_data;
4999
5000 struct stv090x_state *state = NULL;
5001
5002 state = kzalloc(sizeof(*state), GFP_KERNEL);
5003 if (!state) {
5004 ret = -ENOMEM;
5005 goto error;
5006 }
5007
5008 state->verbose = &verbose;
5009 state->config = config;
5010 state->i2c = client->adapter;
5011 state->frontend.ops = stv090x_ops;
5012 state->frontend.demodulator_priv = state;
5013 state->demod = config->demod;
5014 /* Single or Dual mode */
5015 state->demod_mode = config->demod_mode;
5016 state->device = config->device;
5017 /* default */
5018 state->rolloff = STV090x_RO_35;
5019
5020 ret = stv090x_setup_compound(state);
5021 if (ret)
5022 goto error;
stv090x_setup_compound() frees "state" on error.
5023
5024 i2c_set_clientdata(client, state);
5025
5026 /* setup callbacks */
5027 config->get_dvb_frontend = stv090x_get_dvb_frontend;
5028
5029 return 0;
5030
5031 error:
5032 kfree(state);
^^^^^^^^^^^^
Double free.
5033 return ret;
5034 }
regards,
dan carpenter
