gpiolib: Fix use after free in gpiochip_add_pin_range

This is introduced by commit 9ab6e988
"gpiolib: return any error code from range creation".

Signed-off-by: Axel Lin <axel.lin@ingics.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>

diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index 26e27c1fecb1da76aff1d0801bf2741104ed3dff..58b9838801c0df3ca8568e7e9490297cc5bf68fe 100644 (file)
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -1201,6 +1201,7 @@ int gpiochip_add_pin_range(struct gpio_chip *chip, const char *pinctl_name,
                           unsigned int npins)
 {
        struct gpio_pin_range *pin_range;
+       int ret;
 
        pin_range = kzalloc(sizeof(*pin_range), GFP_KERNEL);
        if (!pin_range) {
@@ -1219,10 +1220,11 @@ int gpiochip_add_pin_range(struct gpio_chip *chip, const char *pinctl_name,
        pin_range->pctldev = pinctrl_find_and_add_gpio_range(pinctl_name,
                        &pin_range->range);
        if (IS_ERR(pin_range->pctldev)) {
+               ret = PTR_ERR(pin_range->pctldev);
                pr_err("%s: GPIO chip: could not create pin range\n",
                       chip->label);
                kfree(pin_range);
-               return PTR_ERR(pin_range->pctldev);
+               return ret;
        }
        pr_debug("GPIO chip %s: created GPIO range %d->%d ==> %s PIN %d->%d\n",
                 chip->label, gpio_offset, gpio_offset + npins - 1,