Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a29852be authored by Richard Weinberger's avatar Richard Weinberger Committed by Artem Bityutskiy
Browse files

UBI: fix error handling in ubi_scan() 



Two bad things can happen in ubi_scan():
1. If kmem_cache_create() fails we jump to out_si and call
   ubi_scan_destroy_si() which calls kmem_cache_destroy().
   But si->scan_leb_slab is NULL.
2. If process_eb() fails we jump to out_vidh, call
   kmem_cache_destroy() and ubi_scan_destroy_si() which calls
   again kmem_cache_destroy().

Signed-off-by: default avatarRichard Weinberger <richard@nod.at>
Signed-off-by: default avatarArtem Bityutskiy <artem.bityutskiy@linux.intel.com>
Cc: stable@kernel.org
parent 6b21d18e

drivers/mtd/ubi/scan.c

+4 −4
Original line number Diff line number Diff line
@@ -1174,7 +1174,7 @@ struct ubi_scan_info *ubi_scan(struct ubi_device *ubi) 


	ech = kzalloc(ubi->ec_hdr_alsize, GFP_KERNEL);

	if (!ech)

		goto out_slab;

		goto out_si;



	vidh = ubi_zalloc_vid_hdr(ubi, GFP_KERNEL);

	if (!vidh)
@@ -1235,8 +1235,6 @@ out_vidh: 
	ubi_free_vid_hdr(ubi, vidh);

out_ech:

	kfree(ech);

out_slab:

	kmem_cache_destroy(si->scan_leb_slab);

out_si:

	ubi_scan_destroy_si(si);

	return ERR_PTR(err);
@@ -1325,7 +1323,9 @@ void ubi_scan_destroy_si(struct ubi_scan_info *si) 
		}

	}



	if (si->scan_leb_slab)

		kmem_cache_destroy(si->scan_leb_slab);



	kfree(si);

}