commit 3a2dbd611b38cf9a026c0099a85701ad183d1949
author Vasiliy Kulikov <segoon@openwall.com> Fri Nov 19 21:41:58 2010 +0300
committer Anton Vorontsov <cbouatmailru@gmail.com> Wed Dec 22 02:39:55 2010 +0300
tree b6d181ab33effdcd0e0466ee583c0e224563e372
parent 26eb387265872b59566ddeed5e9bf142a6b9ff5b

power_supply: Fix use after free and memory leak

device_unregister() might free its argument.  This leads to freed
memory use in kfree().  Also use put_device() instead of kfree()
as dev may be already used in another layer after call to device_add().

Signed-off-by: Vasiliy Kulikov <segoon@openwall.com>
Signed-off-by: Anton Vorontsov <cbouatmailru@gmail.com>

drivers/power/power_supply_core.c

diff --git a/drivers/power/power_supply_core.c b/drivers/power/power_supply_core.c
index 91606bb..f06bad04 100644
--- a/drivers/power/power_supply_core.c
+++ b/drivers/power/power_supply_core.c
@@ -190,10 +190,10 @@
 	goto success;
 
 create_triggers_failed:
-	device_unregister(psy->dev);
+	device_del(dev);
 kobject_set_name_failed:
 device_add_failed:
-	kfree(dev);
+	put_device(dev);
 success:
 	return rc;
 }