Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2f87208e authored by Dan Carpenter's avatar Dan Carpenter Committed by David S. Miller
Browse files

drivers: net: davinci_cpdma: double free on error 



We recently change the kzalloc() to devm_kzalloc() so freeing "ctlr"
here could lead to a double free.

Fixes: e1943128 ('drivers: net: davinci_cpdma: Convert kzalloc() to devm_kzalloc().')
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 8fc908c3

drivers/net/ethernet/ti/davinci_cpdma.c

+1 −3
Original line number Diff line number Diff line
@@ -285,10 +285,8 @@ struct cpdma_ctlr *cpdma_ctlr_create(struct cpdma_params *params) 
					    ctlr->params.desc_hw_addr,

					    ctlr->params.desc_mem_size,

					    ctlr->params.desc_align);

	if (!ctlr->pool) {

		kfree(ctlr);

	if (!ctlr->pool)

		return NULL;

	}



	if (WARN_ON(ctlr->num_chan > CPDMA_MAX_CHANNELS))

		ctlr->num_chan = CPDMA_MAX_CHANNELS;