diff options
| author | Wenwen Wang <wenwen@cs.uga.edu> | 2019-08-18 21:46:04 -0500 |
|---|---|---|
| committer | Miquel Raynal <miquel.raynal@bootlin.com> | 2019-08-24 13:13:41 +0200 |
| commit | 86aa04f4c2215912fcca6728f2dcf174f7e31fc4 (patch) | |
| tree | 83e2bf4ce79b3006cc722ae76ccc0ba57a9f6c43 /drivers/mtd/nand/raw/nand_bbt.c | |
| parent | d83aef09aaa50bdafbb32981859128299abf32eb (diff) | |
| download | lwn-86aa04f4c2215912fcca6728f2dcf174f7e31fc4.tar.gz lwn-86aa04f4c2215912fcca6728f2dcf174f7e31fc4.zip | |
mtd: rawnand: Fix a memory leak bug
In nand_scan_bbt(), a temporary buffer 'buf' is allocated through
vmalloc(). However, if check_create() fails, 'buf' is not deallocated,
leading to a memory leak bug. To fix this issue, free 'buf' before
returning the error.
Signed-off-by: Wenwen Wang <wenwen@cs.uga.edu>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Diffstat (limited to 'drivers/mtd/nand/raw/nand_bbt.c')
| -rw-r--r-- | drivers/mtd/nand/raw/nand_bbt.c | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/drivers/mtd/nand/raw/nand_bbt.c b/drivers/mtd/nand/raw/nand_bbt.c index 2ef15ef94525..96045d60471e 100644 --- a/drivers/mtd/nand/raw/nand_bbt.c +++ b/drivers/mtd/nand/raw/nand_bbt.c @@ -1232,7 +1232,7 @@ static int nand_scan_bbt(struct nand_chip *this, struct nand_bbt_descr *bd) if (!td) { if ((res = nand_memory_bbt(this, bd))) { pr_err("nand_bbt: can't scan flash and build the RAM-based BBT\n"); - goto err; + goto err_free_bbt; } return 0; } @@ -1245,7 +1245,7 @@ static int nand_scan_bbt(struct nand_chip *this, struct nand_bbt_descr *bd) buf = vmalloc(len); if (!buf) { res = -ENOMEM; - goto err; + goto err_free_bbt; } /* Is the bbt at a given page? */ @@ -1258,7 +1258,7 @@ static int nand_scan_bbt(struct nand_chip *this, struct nand_bbt_descr *bd) res = check_create(this, buf, bd); if (res) - goto err; + goto err_free_buf; /* Prevent the bbt regions from erasing / writing */ mark_bbt_region(this, td); @@ -1268,7 +1268,9 @@ static int nand_scan_bbt(struct nand_chip *this, struct nand_bbt_descr *bd) vfree(buf); return 0; -err: +err_free_buf: + vfree(buf); +err_free_bbt: kfree(this->bbt); this->bbt = NULL; return res; |