From fe26980e03f435164777184a91c1e5f3b4ed22a5 Mon Sep 17 00:00:00 2001 From: Lars-Peter Clausen Date: Thu, 24 Oct 2013 10:41:00 +0100 Subject: iio: adc: ti_am335x_adc: avoid double free of buffer. The driver is missing the iio_buffer_attach() call. As such it will attempt to free the buffer twice on removal. Introduced in commit 9e69c9 ("iio: Add reference counting for buffers"). Signed-off-by: Lars-Peter Clausen Reported-by: Sebastian Andrzej Siewior Signed-off-by: Jonathan Cameron --- drivers/iio/adc/ti_am335x_adc.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) (limited to 'drivers/iio/adc/ti_am335x_adc.c') diff --git a/drivers/iio/adc/ti_am335x_adc.c b/drivers/iio/adc/ti_am335x_adc.c index 728411ec7642..d4d748214e4b 100644 --- a/drivers/iio/adc/ti_am335x_adc.c +++ b/drivers/iio/adc/ti_am335x_adc.c @@ -229,12 +229,15 @@ static int tiadc_iio_buffered_hardware_setup(struct iio_dev *indio_dev, unsigned long flags, const struct iio_buffer_setup_ops *setup_ops) { + struct iio_buffer *buffer; int ret; - indio_dev->buffer = iio_kfifo_allocate(indio_dev); - if (!indio_dev->buffer) + buffer = iio_kfifo_allocate(indio_dev); + if (!buffer) return -ENOMEM; + iio_device_attach_buffer(indio_dev, buffer); + ret = request_threaded_irq(irq, pollfunc_th, pollfunc_bh, flags, indio_dev->name, indio_dev); if (ret) -- cgit v1.2.1