diff options
| author | Dinghao Liu <dinghao.liu@zju.edu.cn> | 2023-12-14 15:29:43 +0800 |
|---|---|---|
| committer | Miquel Raynal <miquel.raynal@bootlin.com> | 2023-12-14 16:42:01 +0100 |
| commit | 2b8aa4c3e6a5d41b10b53da2017852f647d0345b (patch) | |
| tree | 500da49b74efd27c350439d57852a819dc4cdba7 /drivers/mtd | |
| parent | b6c985dd9a2d5902e413c2e9ba5a770fbca12322 (diff) | |
| download | lwn-2b8aa4c3e6a5d41b10b53da2017852f647d0345b.tar.gz lwn-2b8aa4c3e6a5d41b10b53da2017852f647d0345b.zip | |
mtd: rawnand: diskonchip: fix a potential double free in doc_probe
When nand_scan() fails, it has cleaned up related resources
in its error paths. Therefore, the following nand_cleanup()
may lead to a double-free. One possible trace is:
doc_probe
|-> nand_scan
| |-> nand_scan_with_ids
| |-> nand_scan_tail
| |-> kfree(chip->data_buf) [First free]
|
|-> nand_cleanup
|-> kfree(chip->data_buf) [Double free here]
Fix this by removing nand_cleanup() on failure of
nand_scan().
Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20231214072946.10285-1-dinghao.liu@zju.edu.cn
Diffstat (limited to 'drivers/mtd')
| -rw-r--r-- | drivers/mtd/nand/raw/diskonchip.c | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/drivers/mtd/nand/raw/diskonchip.c b/drivers/mtd/nand/raw/diskonchip.c index 5d2ddb037a9a..5243fab9face 100644 --- a/drivers/mtd/nand/raw/diskonchip.c +++ b/drivers/mtd/nand/raw/diskonchip.c @@ -1491,10 +1491,12 @@ static int __init doc_probe(unsigned long physadr) else numchips = doc2001_init(mtd); - if ((ret = nand_scan(nand, numchips)) || (ret = doc->late_init(mtd))) { - /* DBB note: i believe nand_cleanup is necessary here, as - buffers may have been allocated in nand_base. Check with - Thomas. FIX ME! */ + ret = nand_scan(nand, numchips); + if (ret) + goto fail; + + ret = doc->late_init(mtd); + if (ret) { nand_cleanup(nand); goto fail; } |