diff options
| author | Richard Weinberger <richard@nod.at> | 2012-01-30 18:20:13 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2012-04-02 09:27:17 -0700 |
| commit | 8f418747ea2d87c1394d357b1996ffd6579ae9f4 (patch) | |
| tree | 76e87167dba153553f213bef17da2b28b5cb160d /drivers/mtd/ubi | |
| parent | 9dc6752a3a9a2e8175be539e570268c05397c9a6 (diff) | |
| download | kernel_samsung_smdk4412-8f418747ea2d87c1394d357b1996ffd6579ae9f4.tar.gz kernel_samsung_smdk4412-8f418747ea2d87c1394d357b1996ffd6579ae9f4.tar.bz2 kernel_samsung_smdk4412-8f418747ea2d87c1394d357b1996ffd6579ae9f4.zip | |
UBI: fix error handling in ubi_scan()
commit a29852be492d61001d86c6ebf5fff9b93d7b4be9 upstream.
Two bad things can happen in ubi_scan():
1. If kmem_cache_create() fails we jump to out_si and call
ubi_scan_destroy_si() which calls kmem_cache_destroy().
But si->scan_leb_slab is NULL.
2. If process_eb() fails we jump to out_vidh, call
kmem_cache_destroy() and ubi_scan_destroy_si() which calls
again kmem_cache_destroy().
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/mtd/ubi')
| -rw-r--r-- | drivers/mtd/ubi/scan.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/drivers/mtd/ubi/scan.c b/drivers/mtd/ubi/scan.c index 2135a53732f..0b49eadebc3 100644 --- a/drivers/mtd/ubi/scan.c +++ b/drivers/mtd/ubi/scan.c @@ -1174,7 +1174,7 @@ struct ubi_scan_info *ubi_scan(struct ubi_device *ubi) ech = kzalloc(ubi->ec_hdr_alsize, GFP_KERNEL); if (!ech) - goto out_slab; + goto out_si; vidh = ubi_zalloc_vid_hdr(ubi, GFP_KERNEL); if (!vidh) @@ -1235,8 +1235,6 @@ out_vidh: ubi_free_vid_hdr(ubi, vidh); out_ech: kfree(ech); -out_slab: - kmem_cache_destroy(si->scan_leb_slab); out_si: ubi_scan_destroy_si(si); return ERR_PTR(err); @@ -1325,7 +1323,9 @@ void ubi_scan_destroy_si(struct ubi_scan_info *si) } } - kmem_cache_destroy(si->scan_leb_slab); + if (si->scan_leb_slab) + kmem_cache_destroy(si->scan_leb_slab); + kfree(si); } |