Fix some troubles at list handling

From: Mauro Carvalho Chehab <mchehab@infradead.org>

- priv->count were wrong. Should be incremented since the first usage;
- forgot to use list_del() to remove the driver;
- Release memory if an error occurs during _attach

Thanks to Aidan Thornton <makosoft@googlemail.com> for pointing this.

Signed-off-by: Mauro Carvalho Chehab <mchehab@infradead.org>

1 files changed, 6 insertions, 2 deletions

diff --git a/linux/drivers/media/video/tuner-xc2028.c b/linux/drivers/media/video/tuner-xc2028.c
index 9b6e7c006..4b429759b 100644
--- a/linux/drivers/media/video/tuner-xc2028.c
+++ b/linux/drivers/media/video/tuner-xc2028.c
@@ -653,6 +653,8 @@ static int xc2028_dvb_release(struct dvb_frontend *fe)
 	priv->count--;
 
 	if (!priv->count) {
+		list_del(&priv->xc2028_list);
+
 		if (priv->ctrl.fname)
 			kfree(priv->ctrl.fname);
 
@@ -742,7 +744,6 @@ int xc2028_attach(struct dvb_frontend *fe, struct i2c_adapter* i2c_adap,
 	list_for_each_entry(priv, &xc2028_list, xc2028_list) {
 		if (priv->dev == dev) {
 			dev = NULL;
-			priv->count++;
 		}
 	}
 
@@ -769,8 +770,10 @@ int xc2028_attach(struct dvb_frontend *fe, struct i2c_adapter* i2c_adap,
 
 		priv->ctrl.fname = kmalloc(sizeof(DEFAULT_FIRMWARE)+1,
 					   GFP_KERNEL);
-		if (!priv->ctrl.fname)
+		if (!priv->ctrl.fname) {
+			kfree (priv);
 			return -ENOMEM;
+		}
 
 		strcpy (priv->ctrl.fname, DEFAULT_FIRMWARE);
 #endif
@@ -779,6 +782,7 @@ int xc2028_attach(struct dvb_frontend *fe, struct i2c_adapter* i2c_adap,
 
 		list_add_tail(&priv->xc2028_list,&xc2028_list);
 	}
+	priv->count++;
 
 	memcpy(&fe->ops.tuner_ops, &xc2028_dvb_tuner_ops,
 					       sizeof(xc2028_dvb_tuner_ops));