summaryrefslogtreecommitdiff
path: root/drivers/mtd/nand
diff options
context:
space:
mode:
authorWenwen Wang <wenwen@cs.uga.edu>2019-08-19 05:46:04 +0300
committerMiquel Raynal <miquel.raynal@bootlin.com>2019-08-24 14:13:41 +0300
commit86aa04f4c2215912fcca6728f2dcf174f7e31fc4 (patch)
tree83e2bf4ce79b3006cc722ae76ccc0ba57a9f6c43 /drivers/mtd/nand
parentd83aef09aaa50bdafbb32981859128299abf32eb (diff)
downloadlinux-86aa04f4c2215912fcca6728f2dcf174f7e31fc4.tar.xz
mtd: rawnand: Fix a memory leak bug
In nand_scan_bbt(), a temporary buffer 'buf' is allocated through vmalloc(). However, if check_create() fails, 'buf' is not deallocated, leading to a memory leak bug. To fix this issue, free 'buf' before returning the error. Signed-off-by: Wenwen Wang <wenwen@cs.uga.edu> Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Diffstat (limited to 'drivers/mtd/nand')
-rw-r--r--drivers/mtd/nand/raw/nand_bbt.c10
1 files changed, 6 insertions, 4 deletions
diff --git a/drivers/mtd/nand/raw/nand_bbt.c b/drivers/mtd/nand/raw/nand_bbt.c
index 2ef15ef94525..96045d60471e 100644
--- a/drivers/mtd/nand/raw/nand_bbt.c
+++ b/drivers/mtd/nand/raw/nand_bbt.c
@@ -1232,7 +1232,7 @@ static int nand_scan_bbt(struct nand_chip *this, struct nand_bbt_descr *bd)
if (!td) {
if ((res = nand_memory_bbt(this, bd))) {
pr_err("nand_bbt: can't scan flash and build the RAM-based BBT\n");
- goto err;
+ goto err_free_bbt;
}
return 0;
}
@@ -1245,7 +1245,7 @@ static int nand_scan_bbt(struct nand_chip *this, struct nand_bbt_descr *bd)
buf = vmalloc(len);
if (!buf) {
res = -ENOMEM;
- goto err;
+ goto err_free_bbt;
}
/* Is the bbt at a given page? */
@@ -1258,7 +1258,7 @@ static int nand_scan_bbt(struct nand_chip *this, struct nand_bbt_descr *bd)
res = check_create(this, buf, bd);
if (res)
- goto err;
+ goto err_free_buf;
/* Prevent the bbt regions from erasing / writing */
mark_bbt_region(this, td);
@@ -1268,7 +1268,9 @@ static int nand_scan_bbt(struct nand_chip *this, struct nand_bbt_descr *bd)
vfree(buf);
return 0;
-err:
+err_free_buf:
+ vfree(buf);
+err_free_bbt:
kfree(this->bbt);
this->bbt = NULL;
return res;