* [PATCH] mtd: nand: gpmi: Fix a double free in gpmi_nand_init
@ 2021-04-03 6:09 Lv Yunlong
2021-04-07 9:06 ` Miquel Raynal
0 siblings, 1 reply; 2+ messages in thread
From: Lv Yunlong @ 2021-04-03 6:09 UTC (permalink / raw)
To: han.xu, miquel.raynal, richard, vigneshr, bbrezillon
Cc: linux-mtd, linux-kernel, Lv Yunlong
If the callee gpmi_alloc_dma_buffer() failed to alloc memory for
this->raw_buffer, gpmi_free_dma_buffer() will be called to free
this->auxiliary_virt. But this->auxiliary_virt is still a non-NULL
and valid ptr.
Then gpmi_alloc_dma_buffer() returns err and gpmi_free_dma_buffer()
is called again to free this->auxiliary_virt in err_out. This causes
a double free.
As gpmi_free_dma_buffer() has already called in gpmi_alloc_dma_buffer's
error path, so it should return err directly instead of releasing the dma
buffer again.
Fixes: 4d02423e9afe6 ("mtd: nand: gpmi: Fix gpmi_nand_init() error path")
Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
---
drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
index 3fa8c22d3f36..4d08e4ab5c1b 100644
--- a/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
+++ b/drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c
@@ -2449,7 +2449,7 @@ static int gpmi_nand_init(struct gpmi_nand_data *this)
this->bch_geometry.auxiliary_size = 128;
ret = gpmi_alloc_dma_buffer(this);
if (ret)
- goto err_out;
+ return ret;
nand_controller_init(&this->base);
this->base.ops = &gpmi_nand_controller_ops;
--
2.25.1
______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] mtd: nand: gpmi: Fix a double free in gpmi_nand_init
2021-04-03 6:09 [PATCH] mtd: nand: gpmi: Fix a double free in gpmi_nand_init Lv Yunlong
@ 2021-04-07 9:06 ` Miquel Raynal
0 siblings, 0 replies; 2+ messages in thread
From: Miquel Raynal @ 2021-04-07 9:06 UTC (permalink / raw)
To: Lv Yunlong, han.xu, miquel.raynal, richard, vigneshr, bbrezillon
Cc: linux-mtd, linux-kernel
On Sat, 2021-04-03 at 06:09:05 UTC, Lv Yunlong wrote:
> If the callee gpmi_alloc_dma_buffer() failed to alloc memory for
> this->raw_buffer, gpmi_free_dma_buffer() will be called to free
> this->auxiliary_virt. But this->auxiliary_virt is still a non-NULL
> and valid ptr.
>
> Then gpmi_alloc_dma_buffer() returns err and gpmi_free_dma_buffer()
> is called again to free this->auxiliary_virt in err_out. This causes
> a double free.
>
> As gpmi_free_dma_buffer() has already called in gpmi_alloc_dma_buffer's
> error path, so it should return err directly instead of releasing the dma
> buffer again.
>
> Fixes: 4d02423e9afe6 ("mtd: nand: gpmi: Fix gpmi_nand_init() error path")
> Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
Applied to https://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux.git nand/next, thanks.
Miquel
______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2021-04-07 9:07 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-04-03 6:09 [PATCH] mtd: nand: gpmi: Fix a double free in gpmi_nand_init Lv Yunlong
2021-04-07 9:06 ` Miquel Raynal
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).