Linux-mtd Archive on
 help / color / Atom feed
* [PATCH] mtd: phram: fix a double free issue in error path
@ 2020-03-18 15:27 Wen Yang
  0 siblings, 0 replies; only message in thread
From: Wen Yang @ 2020-03-18 15:27 UTC (permalink / raw)
  To: Joern Engel, Miquel Raynal, Richard Weinberger, Vignesh Raghavendra
  Cc: linux-mtd, Wen Yang, linux-kernel

The variable 'name' is released multiple times in the error path,
which may cause double.
This problem is avoided by adding a goto label to release memory
uniformly. This change also makes the code a bit more cleaner.

Fixes: 4f678a58d335 ("mtd: fix memory leaks in phram_setup")
Signed-off-by: Wen Yang <>
Cc: Joern Engel <>
Cc: Miquel Raynal <>
Cc: Richard Weinberger <>
Cc: Vignesh Raghavendra <>
 drivers/mtd/devices/phram.c | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/drivers/mtd/devices/phram.c b/drivers/mtd/devices/phram.c
index 931e5c2481b5..b50ec7ecd10c 100644
--- a/drivers/mtd/devices/phram.c
+++ b/drivers/mtd/devices/phram.c
@@ -243,22 +243,25 @@ static int phram_setup(const char *val)
 	ret = parse_num64(&start, token[1]);
 	if (ret) {
-		kfree(name);
 		parse_err("illegal start address\n");
+		goto error;
 	ret = parse_num64(&len, token[2]);
 	if (ret) {
-		kfree(name);
 		parse_err("illegal device length\n");
+		goto error;
 	ret = register_device(name, start, len);
-	if (!ret)
-		pr_info("%s device: %#llx at %#llx\n", name, len, start);
-	else
-		kfree(name);
+	if (ret)
+		goto error;
+	pr_info("%s device: %#llx at %#llx\n", name, len, start);
+	return 0;
+	kfree(name);
 	return ret;

Linux MTD discussion mailing list

^ permalink raw reply	[flat|nested] only message in thread

only message in thread, back to index

Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-03-18 15:27 [PATCH] mtd: phram: fix a double free issue in error path Wen Yang

Linux-mtd Archive on

Archives are clonable:
	git clone --mirror linux-mtd/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-mtd linux-mtd/ \
	public-inbox-index linux-mtd

Example config snippet for mirrors

Newsgroup available over NNTP:

AGPL code for this site: git clone