Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7d963cbe authored by Johan Hovold's avatar Johan Hovold Committed by Greg Kroah-Hartman
Browse files

greybus: manifest: fix illegal free in error path 



The manifest-parsing code could end up leaving the interface
vendor_string set to an error pointer that we'd eventually try to free
when destroying the interface.

Signed-off-by: default avatarJohan Hovold <johan@hovoldconsulting.com>
Reviewed-by: default avatarViresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@google.com>
parent d1d67714

drivers/staging/greybus/manifest.c

+7 −4
Original line number Diff line number Diff line
@@ -384,15 +384,18 @@ static bool gb_manifest_parse_interface(struct gb_interface *intf, 
					struct manifest_desc *interface_desc)

{

	struct greybus_descriptor_interface *desc_intf = interface_desc->data;

	char *str;



	/* Handle the strings first--they can fail */

	intf->vendor_string = gb_string_get(intf, desc_intf->vendor_stringid);

	if (IS_ERR(intf->vendor_string))

	str = gb_string_get(intf, desc_intf->vendor_stringid);

	if (IS_ERR(str))

		return false;

	intf->vendor_string = str;



	intf->product_string = gb_string_get(intf, desc_intf->product_stringid);

	if (IS_ERR(intf->product_string))

	str = gb_string_get(intf, desc_intf->product_stringid);

	if (IS_ERR(str))

		goto out_free_vendor_string;

	intf->product_string = str;



	/* Release the interface descriptor, now that we're done with it */

	release_manifest_descriptor(interface_desc);