Commit dfdf1414 authored Feb 08, 2016 by Rasmus Villemoes Committed by Greg Kroah-Hartman Feb 11, 2016

nvmem: core: fix error path in nvmem_add_cells()



The current code fails to nvmem_cell_drop(cells[0]) - even worse, if
the loop above fails already at i==0, we'll enter an essentially
infinite loop doing nvmem_cell_drop on cells[-1], cells[-2], ... which
is unlikely to end well.

Also, we're not freeing the temporary backing array cells on the error
path.

Signed-off-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent 990162f0

drivers/nvmem/core.c

+3 −1

Original line number	Original line	Diff line number	Diff line
	@@ -294,9 +294,11 @@ static int nvmem_add_cells(struct nvmem_device *nvmem,

	return 0;		return 0;
	err:		err:
	while (--i)		while (i--)
	nvmem_cell_drop(cells[i]);		nvmem_cell_drop(cells[i]);

			kfree(cells);

	return rval;		return rval;
	}		}