diff options
author | H Hartley Sweeten <hartleys@visionengravers.com> | 2009-10-07 17:08:08 -0400 |
---|---|---|
committer | David Woodhouse <David.Woodhouse@intel.com> | 2009-10-17 10:41:11 -0400 |
commit | d4702669b0b64b8fa7c91123639ec20d9592ee43 (patch) | |
tree | a5f0be652b0a21b52194814de874a91d5cbe0358 /drivers/mtd | |
parent | f54d6336372b97d3624d1c5c179b2dd062472bd1 (diff) |
mtd: fix memory leak in mtd_dataflash
Fix a potential memory leak in mtd_dataflash driver.
The private data that is allocated when registering a DataFlash
device with the MTD subsystem is not released if an error occurs
when add_mtd_partitions() or add_mtd_device() is called. Fix this
by adding an error path. The memory is already released during a
remove.
Also, add a dev_set_drvdata(&spi->dev, NULL) before the kfree() so
that the spi device does not reference invalid data.
Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Cc: David Brownell <david-b@pacbell.net>
Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Diffstat (limited to 'drivers/mtd')
-rw-r--r-- | drivers/mtd/devices/mtd_dataflash.c | 19 |
1 files changed, 16 insertions, 3 deletions
diff --git a/drivers/mtd/devices/mtd_dataflash.c b/drivers/mtd/devices/mtd_dataflash.c index 93e3627be74c..19817404ce7d 100644 --- a/drivers/mtd/devices/mtd_dataflash.c +++ b/drivers/mtd/devices/mtd_dataflash.c | |||
@@ -636,6 +636,7 @@ add_dataflash_otp(struct spi_device *spi, char *name, | |||
636 | struct mtd_info *device; | 636 | struct mtd_info *device; |
637 | struct flash_platform_data *pdata = spi->dev.platform_data; | 637 | struct flash_platform_data *pdata = spi->dev.platform_data; |
638 | char *otp_tag = ""; | 638 | char *otp_tag = ""; |
639 | int err = 0; | ||
639 | 640 | ||
640 | priv = kzalloc(sizeof *priv, GFP_KERNEL); | 641 | priv = kzalloc(sizeof *priv, GFP_KERNEL); |
641 | if (!priv) | 642 | if (!priv) |
@@ -693,13 +694,23 @@ add_dataflash_otp(struct spi_device *spi, char *name, | |||
693 | 694 | ||
694 | if (nr_parts > 0) { | 695 | if (nr_parts > 0) { |
695 | priv->partitioned = 1; | 696 | priv->partitioned = 1; |
696 | return add_mtd_partitions(device, parts, nr_parts); | 697 | err = add_mtd_partitions(device, parts, nr_parts); |
698 | goto out; | ||
697 | } | 699 | } |
698 | } else if (pdata && pdata->nr_parts) | 700 | } else if (pdata && pdata->nr_parts) |
699 | dev_warn(&spi->dev, "ignoring %d default partitions on %s\n", | 701 | dev_warn(&spi->dev, "ignoring %d default partitions on %s\n", |
700 | pdata->nr_parts, device->name); | 702 | pdata->nr_parts, device->name); |
701 | 703 | ||
702 | return add_mtd_device(device) == 1 ? -ENODEV : 0; | 704 | if (add_mtd_device(device) == 1) |
705 | err = -ENODEV; | ||
706 | |||
707 | out: | ||
708 | if (!err) | ||
709 | return 0; | ||
710 | |||
711 | dev_set_drvdata(&spi->dev, NULL); | ||
712 | kfree(priv); | ||
713 | return err; | ||
703 | } | 714 | } |
704 | 715 | ||
705 | static inline int __devinit | 716 | static inline int __devinit |
@@ -932,8 +943,10 @@ static int __devexit dataflash_remove(struct spi_device *spi) | |||
932 | status = del_mtd_partitions(&flash->mtd); | 943 | status = del_mtd_partitions(&flash->mtd); |
933 | else | 944 | else |
934 | status = del_mtd_device(&flash->mtd); | 945 | status = del_mtd_device(&flash->mtd); |
935 | if (status == 0) | 946 | if (status == 0) { |
947 | dev_set_drvdata(&spi->dev, NULL); | ||
936 | kfree(flash); | 948 | kfree(flash); |
949 | } | ||
937 | return status; | 950 | return status; |
938 | } | 951 | } |
939 | 952 | ||