@@ -900,6 +900,7 @@ read_rtc:
exit_irq:
rtc_device_unregister(ds1307->rtc);
exit_free:
+ i2c_set_clientdata(client, NULL);
kfree(ds1307);
return err;
}
@@ -917,6 +918,7 @@ static int __devexit ds1307_remove(struct i2c_client *client)
sysfs_remove_bin_file(&client->dev.kobj, &nvram);
rtc_device_unregister(ds1307->rtc);
+ i2c_set_clientdata(client, NULL);
kfree(ds1307);
return 0;
}
@@ -462,6 +462,7 @@ exit_bad:
}
return 0;
exit_free:
+ i2c_set_clientdata(client, NULL);
kfree(fm3130);
return err;
}
@@ -471,6 +472,7 @@ static int __devexit fm3130_remove(struct i2c_client *client)
struct fm3130 *fm3130 = i2c_get_clientdata(client);
rtc_device_unregister(fm3130->rtc);
+ i2c_set_clientdata(client, NULL);
kfree(fm3130);
return 0;
}
@@ -863,6 +863,7 @@ ht_err:
exit:
if (rtc)
rtc_device_unregister(rtc);
+ i2c_set_clientdata(client, NULL);
kfree(clientdata);
return rc;
}
@@ -880,6 +881,7 @@ static int m41t80_remove(struct i2c_client *client)
#endif
if (rtc)
rtc_device_unregister(rtc);
+ i2c_set_clientdata(client, NULL);
kfree(clientdata);
return 0;
@@ -225,6 +225,7 @@ static int pcf8563_probe(struct i2c_client *client,
return 0;
exit_kfree:
+ i2c_set_clientdata(client, NULL);
kfree(pcf8563);
return err;
@@ -237,6 +238,7 @@ static int pcf8563_remove(struct i2c_client *client)
if (pcf8563->rtc)
rtc_device_unregister(pcf8563->rtc);
+ i2c_set_clientdata(client, NULL);
kfree(pcf8563);
return 0;
@@ -290,6 +290,7 @@ static int pcf8583_probe(struct i2c_client *client,
return 0;
exit_kfree:
+ i2c_set_clientdata(client, NULL);
kfree(pcf8583);
return err;
}
@@ -300,6 +301,7 @@ static int __devexit pcf8583_remove(struct i2c_client *client)
if (pcf8583->rtc)
rtc_device_unregister(pcf8583->rtc);
+ i2c_set_clientdata(client, NULL);
kfree(pcf8583);
return 0;
}
@@ -694,6 +694,7 @@ exit_devreg:
rtc_device_unregister(rs5c372->rtc);
exit_kfree:
+ i2c_set_clientdata(client, NULL);
kfree(rs5c372);
exit:
@@ -706,6 +707,7 @@ static int rs5c372_remove(struct i2c_client *client)
rtc_device_unregister(rs5c372->rtc);
rs5c_sysfs_unregister(&client->dev);
+ i2c_set_clientdata(client, NULL);
kfree(rs5c372);
return 0;
}
@@ -274,8 +274,8 @@ exit_dummy:
for (i = 1; i < 8; ++i)
if (s35390a->client[i])
i2c_unregister_device(s35390a->client[i]);
- kfree(s35390a);
i2c_set_clientdata(client, NULL);
+ kfree(s35390a);
exit:
return err;
@@ -291,8 +291,8 @@ static int s35390a_remove(struct i2c_client *client)
i2c_unregister_device(s35390a->client[i]);
rtc_device_unregister(s35390a->rtc);
- kfree(s35390a);
i2c_set_clientdata(client, NULL);
+ kfree(s35390a);
return 0;
}
Fix I2C-drivers which missed setting clientdata to NULL before freeing the structure it points to. Also fix drivers which do this _after_ the structure was freed already. Signed-off-by: Wolfram Sang <w.sang@pengutronix.de> Cc: Paul Gortmaker <p_gortmaker@yahoo.com> Cc: Alessandro Zummo <a.zummo@towertech.it> --- Found using coccinelle, then reviewed. Full patchset is available via kernel-janitors, linux-i2c, and LKML. --- drivers/rtc/rtc-ds1307.c | 2 ++ drivers/rtc/rtc-fm3130.c | 2 ++ drivers/rtc/rtc-m41t80.c | 2 ++ drivers/rtc/rtc-pcf8563.c | 2 ++ drivers/rtc/rtc-pcf8583.c | 2 ++ drivers/rtc/rtc-rs5c372.c | 2 ++ drivers/rtc/rtc-s35390a.c | 4 ++-- 7 files changed, 14 insertions(+), 2 deletions(-)