[PATCH] iio: dummy: free software device on configfs release

[Guangshuo Li]

iio_dummy_probe() allocates struct iio_sw_device with kzalloc_obj().
The error paths free it, but after successful registration the normal
removal path only frees the contained IIO device, leaving the software
device allocation behind.

The software device embeds a config_group. device_drop_group() calls
iio_sw_device_destroy() and then drops the config_item reference with
config_item_put(). Therefore, freeing the software device directly from
iio_dummy_remove() would free the embedded config_item before that
final put.

Configfs requires dynamically allocated config_items to provide a
release callback which frees the containing object when the reference
count reaches zero.

Add a release callback to iio_dummy_type and free the software device
there.

This issue was found by manual code inspection.

Fixes: 3d85fb6f8104 ("iio: dummy: Convert IIO dummy to configfs")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Guangshuo Li <lgs201920130244@xxxxxxxxx>
---
 drivers/iio/dummy/iio_simple_dummy.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/drivers/iio/dummy/iio_simple_dummy.c b/drivers/iio/dummy/iio_simple_dummy.c
index 19fcdbbc11c6..7d2ff1d4a06e 100644
--- a/drivers/iio/dummy/iio_simple_dummy.c
+++ b/drivers/iio/dummy/iio_simple_dummy.c
@@ -23,7 +23,19 @@
 #include <linux/iio/sw_device.h>
 #include "iio_simple_dummy.h"
 
+static void iio_dummy_release(struct config_item *item)
+{
+	struct iio_sw_device *swd = to_iio_sw_device(item);
+
+	kfree(swd);
+}
+
+static const struct configfs_item_operations iio_dummy_item_ops = {
+	.release = iio_dummy_release,
+};
+
 static const struct config_item_type iio_dummy_type = {
+	.ct_item_ops = &iio_dummy_item_ops,
 	.ct_owner = THIS_MODULE,
 };
 
-- 
2.43.0