* [PATCH] UBI: Fix error handling in ubi_scan()
@ 2012-01-30 17:20 Richard Weinberger
2012-02-03 5:46 ` Artem Bityutskiy
0 siblings, 1 reply; 2+ messages in thread
From: Richard Weinberger @ 2012-01-30 17:20 UTC (permalink / raw)
To: dedekind1; +Cc: dwmw2, linux-mtd, linux-kernel, Richard Weinberger, stable
Two bad things can happen in ubi_scan():
1. If kmem_cache_create() fails we jump to out_si and call
ubi_scan_destroy_si() which calls kmem_cache_destroy().
But si->scan_leb_slab is NULL.
2. If process_eb() fails we jump to out_vidh, call
kmem_cache_destroy() and ubi_scan_destroy_si() which calls
again kmem_cache_destroy().
Signed-off-by: Richard Weinberger <richard@nod.at>
CC: stable@kernel.org
---
drivers/mtd/ubi/scan.c | 8 ++++----
1 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/mtd/ubi/scan.c b/drivers/mtd/ubi/scan.c
index 0cb17d9..b99318e 100644
--- a/drivers/mtd/ubi/scan.c
+++ b/drivers/mtd/ubi/scan.c
@@ -1174,7 +1174,7 @@ struct ubi_scan_info *ubi_scan(struct ubi_device *ubi)
ech = kzalloc(ubi->ec_hdr_alsize, GFP_KERNEL);
if (!ech)
- goto out_slab;
+ goto out_si;
vidh = ubi_zalloc_vid_hdr(ubi, GFP_KERNEL);
if (!vidh)
@@ -1235,8 +1235,6 @@ out_vidh:
ubi_free_vid_hdr(ubi, vidh);
out_ech:
kfree(ech);
-out_slab:
- kmem_cache_destroy(si->scan_leb_slab);
out_si:
ubi_scan_destroy_si(si);
return ERR_PTR(err);
@@ -1325,7 +1323,9 @@ void ubi_scan_destroy_si(struct ubi_scan_info *si)
}
}
- kmem_cache_destroy(si->scan_leb_slab);
+ if (si->scan_leb_slab)
+ kmem_cache_destroy(si->scan_leb_slab);
+
kfree(si);
}
--
1.7.8.3
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] UBI: Fix error handling in ubi_scan()
2012-01-30 17:20 [PATCH] UBI: Fix error handling in ubi_scan() Richard Weinberger
@ 2012-02-03 5:46 ` Artem Bityutskiy
0 siblings, 0 replies; 2+ messages in thread
From: Artem Bityutskiy @ 2012-02-03 5:46 UTC (permalink / raw)
To: Richard Weinberger; +Cc: dwmw2, linux-mtd, linux-kernel, stable
[-- Attachment #1: Type: text/plain, Size: 494 bytes --]
On Mon, 2012-01-30 at 18:20 +0100, Richard Weinberger wrote:
> Two bad things can happen in ubi_scan():
> 1. If kmem_cache_create() fails we jump to out_si and call
> ubi_scan_destroy_si() which calls kmem_cache_destroy().
> But si->scan_leb_slab is NULL.
> 2. If process_eb() fails we jump to out_vidh, call
> kmem_cache_destroy() and ubi_scan_destroy_si() which calls
> again kmem_cache_destroy().
Pushed to ubi-2.6.git, thanks!
--
Best Regards,
Artem Bityutskiy
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 836 bytes --]
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2012-02-03 5:44 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2012-01-30 17:20 [PATCH] UBI: Fix error handling in ubi_scan() Richard Weinberger
2012-02-03 5:46 ` Artem Bityutskiy
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).