staging: tidspbridge: Remove cfg_get_dev_object() and do a trivial cleanup

The cfg_get_dev_object function is only used in one place and because of
its simplicity, it can be removed.

The parameter *value can be left uninitialized if the strcmp() returns a
nonzero value, so in the function dev_remove_device(), the hdev_obj could
be used uninitialized and could be dereferenced in dev_destroy_device().
This patch fixes this issue, and also removes the dev_obj pointer which
is not used.

Signed-off-by: Ivan Gomez Castellanos <ivan.gomez@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

1 files changed, 24 insertions, 6 deletions

diff --git a/drivers/staging/tidspbridge/pmgr/dev.c b/drivers/staging/tidspbridge/pmgr/dev.c
index 4ddf03d3b1a..7893f9a0cf0 100644
--- a/drivers/staging/tidspbridge/pmgr/dev.c
+++ b/drivers/staging/tidspbridge/pmgr/dev.c
@@ -85,6 +85,11 @@ struct dev_object {
         struct node_mgr *hnode_mgr;
 };
 
+struct drv_ext {
+        struct list_head link;
+        char sz_string[MAXREGPATHLENGTH];
+};
+
 /*  ----------------------------------- Globals */
 static u32 refs;                /* Module reference count */
 
@@ -812,18 +817,31 @@ int dev_remove_device(struct cfg_devnode *dev_node_obj)
 {
         struct dev_object *hdev_obj;    /* handle to device object */
         int status = 0;
-        struct dev_object *dev_obj;
+        struct drv_data *drv_datap = dev_get_drvdata(bridge);
+
+        if (!drv_datap)
+                status = -ENODATA;
+
+        if (!dev_node_obj)
+                status = -EFAULT;
 
         /* Retrieve the device object handle originaly stored with
          * the dev_node: */
-        status = cfg_get_dev_object(dev_node_obj, (u32 *) &hdev_obj);
         if (!status) {
-                /* Remove the Processor List */
-                dev_obj = (struct dev_object *)hdev_obj;
-                /* Destroy the device object. */
-                status = dev_destroy_device(hdev_obj);
+                /* check the device string and then store dev object */
+                if (!strcmp((char *)((struct drv_ext *)dev_node_obj)->sz_string,
+                                                                "TIOMAP1510")) {
+                        hdev_obj = drv_datap->dev_object;
+                        /* Destroy the device object. */
+                        status = dev_destroy_device(hdev_obj);
+                } else {
+                        status = -EPERM;
+                }
         }
 
+        if (status)
+                pr_err("%s: Failed, status 0x%x\n", __func__, status);
+
         return status;
 }