A label duplication failure currently reaches the terminating-byte
write. Release the ACPI result and abort before accessing the missing
label; earlier labels are managed by devres.

Detected by static analysis and reviewed with AI-assisted source auditing.

Fixes: 0fb528c8255b ("iio: adc: adding support for PAC193x")
Assisted-by: LLM
Signed-off-by: Slavin Liu <bolin.liu@seu.edu.cn>
---
 drivers/iio/adc/pac1934.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/iio/adc/pac1934.c b/drivers/iio/adc/pac1934.c
index 23055405a6e0..de59dc27c440 100644
--- a/drivers/iio/adc/pac1934.c
+++ b/drivers/iio/adc/pac1934.c
@@ -1108,6 +1108,10 @@ static int pac1934_acpi_parse_channel_config(struct i2c_client *client,
 			devm_kmemdup(dev, rez->package.elements[i].string.pointer,
 				     (size_t)rez->package.elements[i].string.length + 1,
 				     GFP_KERNEL);
+		if (!info->labels[idx]) {
+			ACPI_FREE(rez);
+			return -ENOMEM;
+		}
 		info->labels[idx][rez->package.elements[i].string.length] = '\0';
 		info->shunts[idx] = rez->package.elements[i + 1].integer.value * 1000;
 		info->active_channels[idx] = (info->shunts[idx] != 0);

On Sun, 13 Sep 2026 20:51:07 +0800
Slavin Liu <bolin.liu@seu.edu.cn> wrote:

> A label duplication failure currently reaches the terminating-byte
> write. Release the ACPI result and abort before accessing the missing
> label; earlier labels are managed by devres.
> 
> Detected by static analysis and reviewed with AI-assisted source auditing.
> 
> Fixes: 0fb528c8255b ("iio: adc: adding support for PAC193x")
> Assisted-by: LLM
> Signed-off-by: Slavin Liu <bolin.liu@seu.edu.cn>

Applied to the fixes-togreg branch of iio.git but as it is a low
priority type of fix (these allocations don't fail in practice except
when things are already in a mess!) it may well wait for the next merge
window.

> ---
>  drivers/iio/adc/pac1934.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/drivers/iio/adc/pac1934.c b/drivers/iio/adc/pac1934.c
> index 23055405a6e0..de59dc27c440 100644
> --- a/drivers/iio/adc/pac1934.c
> +++ b/drivers/iio/adc/pac1934.c
> @@ -1108,6 +1108,10 @@ static int pac1934_acpi_parse_channel_config(struct i2c_client *client,
>  			devm_kmemdup(dev, rez->package.elements[i].string.pointer,
>  				     (size_t)rez->package.elements[i].string.length + 1,
>  				     GFP_KERNEL);
> +		if (!info->labels[idx]) {
> +			ACPI_FREE(rez);
> +			return -ENOMEM;
> +		}
>  		info->labels[idx][rez->package.elements[i].string.length] = '\0';
>  		info->shunts[idx] = rez->package.elements[i + 1].integer.value * 1000;
>  		info->active_channels[idx] = (info->shunts[idx] != 0);
>