Skip to content

Commit

Permalink
mtd: phram: fix a double free issue in error path
Browse files Browse the repository at this point in the history
commit 49c64df upstream.

The variable 'name' is released multiple times in the error path,
which may cause double free issues.
This problem is avoided by adding a goto label to release the memory
uniformly. And this change also makes the code a bit more cleaner.

Fixes: 4f678a5 ("mtd: fix memory leaks in phram_setup")
Signed-off-by: Wen Yang <[email protected]>
Cc: Joern Engel <[email protected]>
Cc: Miquel Raynal <[email protected]>
Cc: Richard Weinberger <[email protected]>
Cc: Vignesh Raghavendra <[email protected]>
Cc: [email protected]
Cc: [email protected]
Signed-off-by: Miquel Raynal <[email protected]>
Link: https://lore.kernel.org/linux-mtd/[email protected]
Signed-off-by: Greg Kroah-Hartman <[email protected]>
  • Loading branch information
taskset authored and gregkh committed Apr 23, 2020
1 parent f752144 commit ce2a7dc
Showing 1 changed file with 9 additions and 6 deletions.
15 changes: 9 additions & 6 deletions drivers/mtd/devices/phram.c
Original file line number Diff line number Diff line change
Expand Up @@ -243,22 +243,25 @@ static int phram_setup(const char *val)

ret = parse_num64(&start, token[1]);
if (ret) {
kfree(name);
parse_err("illegal start address\n");
goto error;
}

ret = parse_num64(&len, token[2]);
if (ret) {
kfree(name);
parse_err("illegal device length\n");
goto error;
}

ret = register_device(name, start, len);
if (!ret)
pr_info("%s device: %#llx at %#llx\n", name, len, start);
else
kfree(name);
if (ret)
goto error;

pr_info("%s device: %#llx at %#llx\n", name, len, start);
return 0;

error:
kfree(name);
return ret;
}

Expand Down

0 comments on commit ce2a7dc

Please sign in to comment.