From fa1589a697b38be5619cd801dc795d38b4461235 Mon Sep 17 00:00:00 2001 From: hanzhijian Date: Thu, 28 May 2026 00:49:07 +0800 Subject: [PATCH] drivers/analog: fix dead free and memory leak in mcp48xx and mcp47x6. mcp48xx_initialize() and mcp47x6_initialize() share the same two bugs in their allocation error paths: 1. Dead code: when the first kmm_malloc() fails and priv is NULL, the code calls free(priv) which is a no-op on NULL. Remove it. 2. Memory leak: when the second kmm_malloc() fails (dacdev), the function returns NULL without freeing the already-allocated priv. Add kmm_free(priv) before the return. Signed-off-by: hanzj --- drivers/analog/mcp47x6.c | 2 +- drivers/analog/mcp48xx.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/analog/mcp47x6.c b/drivers/analog/mcp47x6.c index b18a60ad4b3..c96648de5df 100644 --- a/drivers/analog/mcp47x6.c +++ b/drivers/analog/mcp47x6.c @@ -438,7 +438,6 @@ FAR struct dac_dev_s *mcp47x6_initialize(FAR struct i2c_master_s *i2c, if (priv == NULL) { aerr("ERROR: Failed to allocate mcp47x6_dev_s instance\n"); - free(priv); return NULL; } @@ -446,6 +445,7 @@ FAR struct dac_dev_s *mcp47x6_initialize(FAR struct i2c_master_s *i2c, if (dacdev == NULL) { aerr("ERROR: Failed to allocate dac_dev_s instance\n"); + kmm_free(priv); return NULL; } diff --git a/drivers/analog/mcp48xx.c b/drivers/analog/mcp48xx.c index 7d86831a88b..52c75917acf 100644 --- a/drivers/analog/mcp48xx.c +++ b/drivers/analog/mcp48xx.c @@ -344,7 +344,6 @@ FAR struct dac_dev_s *mcp48xx_initialize(FAR struct spi_dev_s *spi, if (priv == NULL) { aerr("ERROR: Failed to allocate mcp48xx_dev_s instance\n"); - free(priv); return NULL; } @@ -352,6 +351,7 @@ FAR struct dac_dev_s *mcp48xx_initialize(FAR struct spi_dev_s *spi, if (dacdev == NULL) { aerr("ERROR: Failed to allocate dac_dev_s instance\n"); + kmm_free(priv); return NULL; }