lkml.org 
[lkml]   [2020]   [Apr]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.4 113/118] mtd: phram: fix a double free issue in error path
    Date
    From: Wen Yang <wenyang@linux.alibaba.com>

    commit 49c64df880570034308e4a9a49c4bc95cf8cdb33 upstream.

    The variable 'name' is released multiple times in the error path,
    which may cause double free issues.
    This problem is avoided by adding a goto label to release the memory
    uniformly. And this change also makes the code a bit more cleaner.

    Fixes: 4f678a58d335 ("mtd: fix memory leaks in phram_setup")
    Signed-off-by: Wen Yang <wenyang@linux.alibaba.com>
    Cc: Joern Engel <joern@lazybastard.org>
    Cc: Miquel Raynal <miquel.raynal@bootlin.com>
    Cc: Richard Weinberger <richard@nod.at>
    Cc: Vignesh Raghavendra <vigneshr@ti.com>
    Cc: linux-mtd@lists.infradead.org
    Cc: linux-kernel@vger.kernel.org
    Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
    Link: https://lore.kernel.org/linux-mtd/20200318153156.25612-1-wenyang@linux.alibaba.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    drivers/mtd/devices/phram.c | 15 +++++++++------
    1 file changed, 9 insertions(+), 6 deletions(-)

    --- a/drivers/mtd/devices/phram.c
    +++ b/drivers/mtd/devices/phram.c
    @@ -243,22 +243,25 @@ static int phram_setup(const char *val)

    ret = parse_num64(&start, token[1]);
    if (ret) {
    - kfree(name);
    parse_err("illegal start address\n");
    + goto error;
    }

    ret = parse_num64(&len, token[2]);
    if (ret) {
    - kfree(name);
    parse_err("illegal device length\n");
    + goto error;
    }

    ret = register_device(name, start, len);
    - if (!ret)
    - pr_info("%s device: %#llx at %#llx\n", name, len, start);
    - else
    - kfree(name);
    + if (ret)
    + goto error;

    + pr_info("%s device: %#llx at %#llx\n", name, len, start);
    + return 0;
    +
    +error:
    + kfree(name);
    return ret;
    }


    \
     
     \ /
      Last update: 2020-04-22 12:41    [W:4.069 / U:0.072 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site