lkml.org 
[lkml]   [2021]   [May]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.4 105/244] mtd: rawnand: gpmi: Fix a double free in gpmi_nand_init
    Date
    From: Lv Yunlong <lyl2019@mail.ustc.edu.cn>

    [ Upstream commit 076de75de1e53160e9b099f75872c1f9adf41a0b ]

    If the callee gpmi_alloc_dma_buffer() failed to alloc memory for
    this->raw_buffer, gpmi_free_dma_buffer() will be called to free
    this->auxiliary_virt. But this->auxiliary_virt is still a non-NULL
    and valid ptr.

    Then gpmi_alloc_dma_buffer() returns err and gpmi_free_dma_buffer()
    is called again to free this->auxiliary_virt in err_out. This causes
    a double free.

    As gpmi_free_dma_buffer() has already called in gpmi_alloc_dma_buffer's
    error path, so it should return err directly instead of releasing the dma
    buffer again.

    Fixes: 4d02423e9afe6 ("mtd: nand: gpmi: Fix gpmi_nand_init() error path")
    Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
    Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
    Link: https://lore.kernel.org/linux-mtd/20210403060905.5251-1-lyl2019@mail.ustc.edu.cn
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    diff --git a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
    index 2390ed077a2f..60f146920b9f 100644
    --- a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
    +++ b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
    @@ -2598,7 +2598,7 @@ static int gpmi_nand_init(struct gpmi_nand_data *this)
    this->bch_geometry.auxiliary_size = 128;
    ret = gpmi_alloc_dma_buffer(this);
    if (ret)
    - goto err_out;
    + return ret;

    nand_controller_init(&this->base);
    this->base.ops = &gpmi_nand_controller_ops;
    --
    2.30.2


    \
     
     \ /
      Last update: 2021-05-12 17:02    [W:4.120 / U:0.044 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site