On Wed, Jun 20, 2018 at 11:34:39AM +0300, Dan Carpenter wrote:
> On Tue, Jun 19, 2018 at 10:33:26PM -0400, Hugo Lefeuvre wrote:
> > @@ -1178,6 +1152,11 @@ static int pi433_probe(struct spi_device *spi)
> > device->tx_active = false;
> > device->interrupt_rx_allowed = false;
> >
> > +
On Tue, Jun 19, 2018 at 10:33:26PM -0400, Hugo Lefeuvre wrote:
> @@ -1178,6 +1152,11 @@ static int pi433_probe(struct spi_device *spi)
> device->tx_active = false;
> device->interrupt_rx_allowed = false;
>
> + /* init rx buffer */
> + device->rx_buffer = kmalloc(MAX_MSG_SIZE,
The device structure contains a useless non-atomic users counter which
is subject to race conditions. It has probably been created to handle
the case where remove is executed while operations are still executing
on open fds but this will never happen because of reference counts.
Drop the users
