Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5547fec7 authored by Dan Carpenter's avatar Dan Carpenter Committed by Artem Bityutskiy
Browse files

UBI: fix some use after free bugs 



Move the kmem_cache_free() calls down a couple lines.

Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarArtem Bityutskiy <artem.bityutskiy@linux.intel.com>
parent 38dbfb59

drivers/mtd/ubi/fastmap.c

+4 −4
Original line number Diff line number Diff line
@@ -463,8 +463,8 @@ static int scan_pool(struct ubi_device *ubi, struct ubi_attach_info *ai, 
				}

			}

			if (found_orphan) {

				kmem_cache_free(ai->aeb_slab_cache, tmp_aeb);

				list_del(&tmp_aeb->u.list);

				kmem_cache_free(ai->aeb_slab_cache, tmp_aeb);

			}



			new_aeb = kmem_cache_alloc(ai->aeb_slab_cache,
@@ -846,16 +846,16 @@ static int ubi_attach_fastmap(struct ubi_device *ubi, 
	ret = UBI_BAD_FASTMAP;

fail:

	list_for_each_entry_safe(tmp_aeb, _tmp_aeb, &used, u.list) {

		kmem_cache_free(ai->aeb_slab_cache, tmp_aeb);

		list_del(&tmp_aeb->u.list);

		kmem_cache_free(ai->aeb_slab_cache, tmp_aeb);

	}

	list_for_each_entry_safe(tmp_aeb, _tmp_aeb, &eba_orphans, u.list) {

		kmem_cache_free(ai->aeb_slab_cache, tmp_aeb);

		list_del(&tmp_aeb->u.list);

		kmem_cache_free(ai->aeb_slab_cache, tmp_aeb);

	}

	list_for_each_entry_safe(tmp_aeb, _tmp_aeb, &free, u.list) {

		kmem_cache_free(ai->aeb_slab_cache, tmp_aeb);

		list_del(&tmp_aeb->u.list);

		kmem_cache_free(ai->aeb_slab_cache, tmp_aeb);

	}



	return ret;