mtd: fix memory leak in mtd_dataflash

[Linux-MTD Mailing List]

Gitweb:     http://git.infradead.org/?p=mtd-2.6.git;a=commit;h=d4702669b0b64b8fa7c91123639ec20d9592ee43
Commit:     d4702669b0b64b8fa7c91123639ec20d9592ee43
Parent:     f54d6336372b97d3624d1c5c179b2dd062472bd1
Author:     H Hartley Sweeten <hartleys at visionengravers.com>
AuthorDate: Wed Oct 7 17:08:08 2009 -0400
Committer:  David Woodhouse <David.Woodhouse at intel.com>
CommitDate: Sat Oct 17 15:41:11 2009 +0100

    mtd: fix memory leak in mtd_dataflash
    
    Fix a potential memory leak in mtd_dataflash driver.
    
    The private data that is allocated when registering a DataFlash
    device with the MTD subsystem is not released if an error occurs
    when add_mtd_partitions() or add_mtd_device() is called.  Fix this
    by adding an error path.  The memory is already released during a
    remove.
    
    Also, add a dev_set_drvdata(&spi->dev, NULL) before the kfree() so
    that the spi device does not reference invalid data.
    
    Signed-off-by: H Hartley Sweeten <hsweeten at visionengravers.com>
    Cc: David Brownell <david-b at pacbell.net>
    Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy at nokia.com>
    Signed-off-by: David Woodhouse <David.Woodhouse at intel.com>
---
 drivers/mtd/devices/mtd_dataflash.c |   19 ++++++++++++++++---
 1 files changed, 16 insertions(+), 3 deletions(-)

diff --git a/drivers/mtd/devices/mtd_dataflash.c b/drivers/mtd/devices/mtd_dataflash.c
index 93e3627..1981740 100644
--- a/drivers/mtd/devices/mtd_dataflash.c
+++ b/drivers/mtd/devices/mtd_dataflash.c
@@ -636,6 +636,7 @@ add_dataflash_otp(struct spi_device *spi, char *name,
 	struct mtd_info			*device;
 	struct flash_platform_data	*pdata = spi->dev.platform_data;
 	char				*otp_tag = "";
+	int				err = 0;
 
 	priv = kzalloc(sizeof *priv, GFP_KERNEL);
 	if (!priv)
@@ -693,13 +694,23 @@ add_dataflash_otp(struct spi_device *spi, char *name,
 
 		if (nr_parts > 0) {
 			priv->partitioned = 1;
-			return add_mtd_partitions(device, parts, nr_parts);
+			err = add_mtd_partitions(device, parts, nr_parts);
+			goto out;
 		}
 	} else if (pdata && pdata->nr_parts)
 		dev_warn(&spi->dev, "ignoring %d default partitions on %s\n",
 				pdata->nr_parts, device->name);
 
-	return add_mtd_device(device) == 1 ? -ENODEV : 0;
+	if (add_mtd_device(device) == 1)
+		err = -ENODEV;
+
+out:
+	if (!err)
+		return 0;
+
+	dev_set_drvdata(&spi->dev, NULL);
+	kfree(priv);
+	return err;
 }
 
 static inline int __devinit
@@ -932,8 +943,10 @@ static int __devexit dataflash_remove(struct spi_device *spi)
 		status = del_mtd_partitions(&flash->mtd);
 	else
 		status = del_mtd_device(&flash->mtd);
-	if (status == 0)
+	if (status == 0) {
+		dev_set_drvdata(&spi->dev, NULL);
 		kfree(flash);
+	}
 	return status;
 }