aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/mtd/mtd_blkdevs.c
diff options
context:
space:
mode:
authorMarcin Slusarz <marcin.slusarz@gmail.com>2009-03-28 13:44:24 -0400
committerDavid Woodhouse <David.Woodhouse@intel.com>2009-04-03 05:36:23 -0400
commit2cf3a11494b15949835ff92a7af15f979ac37bbd (patch)
tree95431300bd2dba8e7d2db8b689e6c2031d4b7a27 /drivers/mtd/mtd_blkdevs.c
parent61dd7eb876344904aece6b1837da6ea1cbadbc07 (diff)
[MTD] fix use after free in register_mtd_blktrans
Reported-by: Dan Carpenter <error27@gmail.com> Cc: Christoph Hellwig <hch@lst.de> Signed-off-by: Marcin Slusarz <marcin.slusarz@gmail.com> Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Diffstat (limited to 'drivers/mtd/mtd_blkdevs.c')
-rw-r--r--drivers/mtd/mtd_blkdevs.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/mtd/mtd_blkdevs.c b/drivers/mtd/mtd_blkdevs.c
index 1409f01406f6..4109e0bb94f5 100644
--- a/drivers/mtd/mtd_blkdevs.c
+++ b/drivers/mtd/mtd_blkdevs.c
@@ -382,11 +382,12 @@ int register_mtd_blktrans(struct mtd_blktrans_ops *tr)
382 tr->blkcore_priv->thread = kthread_run(mtd_blktrans_thread, tr, 382 tr->blkcore_priv->thread = kthread_run(mtd_blktrans_thread, tr,
383 "%sd", tr->name); 383 "%sd", tr->name);
384 if (IS_ERR(tr->blkcore_priv->thread)) { 384 if (IS_ERR(tr->blkcore_priv->thread)) {
385 int ret = PTR_ERR(tr->blkcore_priv->thread);
385 blk_cleanup_queue(tr->blkcore_priv->rq); 386 blk_cleanup_queue(tr->blkcore_priv->rq);
386 unregister_blkdev(tr->major, tr->name); 387 unregister_blkdev(tr->major, tr->name);
387 kfree(tr->blkcore_priv); 388 kfree(tr->blkcore_priv);
388 mutex_unlock(&mtd_table_mutex); 389 mutex_unlock(&mtd_table_mutex);
389 return PTR_ERR(tr->blkcore_priv->thread); 390 return ret;
390 } 391 }
391 392
392 INIT_LIST_HEAD(&tr->devs); 393 INIT_LIST_HEAD(&tr->devs);