iio: adc: xilinx: fix potential use-after-free on remove

[sagit-ice-cold/kernel_xiaomi_msm8998.git] / drivers / iio / adc / xilinx-xadc-core.c

diff --git a/drivers/iio/adc/xilinx-xadc-core.c b/drivers/iio/adc/xilinx-xadc-core.c
index 0370624..6398e86 100644 (file)
--- a/drivers/iio/adc/xilinx-xadc-core.c
+++ b/drivers/iio/adc/xilinx-xadc-core.c
@@ -841,6 +841,7 @@ static int xadc_read_raw(struct iio_dev *indio_dev,
                        case XADC_REG_VCCINT:
                        case XADC_REG_VCCAUX:
                        case XADC_REG_VREFP:
+                       case XADC_REG_VREFN:
                        case XADC_REG_VCCBRAM:
                        case XADC_REG_VCCPINT:
                        case XADC_REG_VCCPAUX:
@@ -1207,7 +1208,7 @@ static int xadc_probe(struct platform_device *pdev)
 
        ret = xadc->ops->setup(pdev, indio_dev, irq);
        if (ret)
-               goto err_free_samplerate_trigger;
+               goto err_clk_disable_unprepare;
 
        ret = request_irq(irq, xadc->ops->interrupt_handler, 0,
                        dev_name(&pdev->dev), indio_dev);
@@ -1267,6 +1268,8 @@ static int xadc_probe(struct platform_device *pdev)
 
 err_free_irq:
        free_irq(irq, indio_dev);
+err_clk_disable_unprepare:
+       clk_disable_unprepare(xadc->clk);
 err_free_samplerate_trigger:
        if (xadc->ops->flags & XADC_FLAGS_BUFFERED)
                iio_trigger_free(xadc->samplerate_trigger);
@@ -1276,8 +1279,6 @@ err_free_convst_trigger:
 err_triggered_buffer_cleanup:
        if (xadc->ops->flags & XADC_FLAGS_BUFFERED)
                iio_triggered_buffer_cleanup(indio_dev);
-err_clk_disable_unprepare:
-       clk_disable_unprepare(xadc->clk);
 err_device_free:
        kfree(indio_dev->channels);
 
@@ -1298,7 +1299,7 @@ static int xadc_remove(struct platform_device *pdev)
        }
        free_irq(irq, indio_dev);
        clk_disable_unprepare(xadc->clk);
-       cancel_delayed_work(&xadc->zynq_unmask_work);
+       cancel_delayed_work_sync(&xadc->zynq_unmask_work);
        kfree(xadc->data);
        kfree(indio_dev->channels);