Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 04e506b5 authored by Vasiliy Kulikov's avatar Vasiliy Kulikov Committed by Jeff Garzik
Browse files

sata_dwc_460ex: fix error path 



Fixed hsdev memleak on sata_dwc_probe() error.
As dma_dwc_exit() can be called multiple times without sata_dma_regs and
irq_dma changes, it might lead to double free on sequential
dma_dwc_exit() calls.  So, zero these fields after free calls.

Signed-off-by: default avatarVasiliy Kulikov <segoon@openwall.com>
Signed-off-by: default avatarJeff Garzik <jgarzik@pobox.com>
parent 3c4aa91f

drivers/ata/sata_dwc_460ex.c

+14 −7
Original line number Diff line number Diff line
@@ -766,11 +766,15 @@ static int dma_dwc_xfer_setup(struct scatterlist *sg, int num_elems, 
static void dma_dwc_exit(struct sata_dwc_device *hsdev)

{

	dev_dbg(host_pvt.dwc_dev, "%s:\n", __func__);

	if (host_pvt.sata_dma_regs)

	if (host_pvt.sata_dma_regs) {

		iounmap(host_pvt.sata_dma_regs);

		host_pvt.sata_dma_regs = NULL;

	}



	if (hsdev->irq_dma)

	if (hsdev->irq_dma) {

		free_irq(hsdev->irq_dma, hsdev);

		hsdev->irq_dma = 0;

	}

}



/*
@@ -1642,7 +1646,7 @@ static int sata_dwc_probe(struct platform_device *ofdev) 
	if (hsdev == NULL) {

		dev_err(&ofdev->dev, "kmalloc failed for hsdev\n");

		err = -ENOMEM;

		goto error_out;

		goto error;

	}

	memset(hsdev, 0, sizeof(*hsdev));
@@ -1652,7 +1656,7 @@ static int sata_dwc_probe(struct platform_device *ofdev) 
		dev_err(&ofdev->dev, "ioremap failed for SATA register"

			" address\n");

		err = -ENODEV;

		goto error_out;

		goto error_kmalloc;

	}

	hsdev->reg_base = base;

	dev_dbg(&ofdev->dev, "ioremap done for SATA register address\n");
@@ -1665,7 +1669,7 @@ static int sata_dwc_probe(struct platform_device *ofdev) 
	if (!host) {

		dev_err(&ofdev->dev, "ata_host_alloc_pinfo failed\n");

		err = -ENOMEM;

		goto error_out;

		goto error_iomap;

	}



	host->private_data = hsdev;
@@ -1733,8 +1737,11 @@ static int sata_dwc_probe(struct platform_device *ofdev) 
	/* Free SATA DMA resources */

	dma_dwc_exit(hsdev);



	if (base)

error_iomap:

	iounmap(base);

error_kmalloc:

	kfree(hsdev);

error:

	return err;

}