Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2cf3a114 authored by Marcin Slusarz's avatar Marcin Slusarz Committed by David Woodhouse
Browse files

[MTD] fix use after free in register_mtd_blktrans 



Reported-by: default avatarDan Carpenter <error27@gmail.com>
Cc: Christoph Hellwig <hch@lst.de>
Signed-off-by: default avatarMarcin Slusarz <marcin.slusarz@gmail.com>
Signed-off-by: default avatarDavid Woodhouse <David.Woodhouse@intel.com>
parent 61dd7eb8

drivers/mtd/mtd_blkdevs.c

+2 −1
Original line number Diff line number Diff line
@@ -382,11 +382,12 @@ int register_mtd_blktrans(struct mtd_blktrans_ops *tr) 
	tr->blkcore_priv->thread = kthread_run(mtd_blktrans_thread, tr,

			"%sd", tr->name);

	if (IS_ERR(tr->blkcore_priv->thread)) {

		int ret = PTR_ERR(tr->blkcore_priv->thread);

		blk_cleanup_queue(tr->blkcore_priv->rq);

		unregister_blkdev(tr->major, tr->name);

		kfree(tr->blkcore_priv);

		mutex_unlock(&mtd_table_mutex);

		return PTR_ERR(tr->blkcore_priv->thread);

		return ret;

	}



	INIT_LIST_HEAD(&tr->devs);