You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
35 lines
966 B
Diff
35 lines
966 B
Diff
From dfdf141429f0895b63c882facc42c86f225033cb Mon Sep 17 00:00:00 2001
|
|
From: Rasmus Villemoes <linux@rasmusvillemoes.dk>
|
|
Date: Mon, 8 Feb 2016 22:04:29 +0100
|
|
Subject: nvmem: core: fix error path in nvmem_add_cells()
|
|
|
|
The current code fails to nvmem_cell_drop(cells[0]) - even worse, if
|
|
the loop above fails already at i==0, we'll enter an essentially
|
|
infinite loop doing nvmem_cell_drop on cells[-1], cells[-2], ... which
|
|
is unlikely to end well.
|
|
|
|
Also, we're not freeing the temporary backing array cells on the error
|
|
path.
|
|
|
|
Signed-off-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>
|
|
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
|
---
|
|
drivers/nvmem/core.c | 4 +++-
|
|
1 file changed, 3 insertions(+), 1 deletion(-)
|
|
|
|
--- a/drivers/nvmem/core.c
|
|
+++ b/drivers/nvmem/core.c
|
|
@@ -294,9 +294,11 @@ static int nvmem_add_cells(struct nvmem_
|
|
|
|
return 0;
|
|
err:
|
|
- while (--i)
|
|
+ while (i--)
|
|
nvmem_cell_drop(cells[i]);
|
|
|
|
+ kfree(cells);
|
|
+
|
|
return rval;
|
|
}
|
|
|