diff options
| author | Vasiliy Kulikov <segoon@openwall.com> | 2011-07-03 15:26:47 +0400 |
|---|---|---|
| committer | Jeff Garzik <jgarzik@pobox.com> | 2011-07-23 18:03:54 -0400 |
| commit | 04e506b5e7bd61c3a99af9964f7f1177c17f3424 (patch) | |
| tree | 7448465bc6c2662ec3b7a7a3e5c3de2edc31663b | |
| parent | 3c4aa91f21f65b7b40bdfb015eacbcb8453ccae2 (diff) | |
sata_dwc_460ex: fix error path
Fixed hsdev memleak on sata_dwc_probe() error.
As dma_dwc_exit() can be called multiple times without sata_dma_regs and
irq_dma changes, it might lead to double free on sequential
dma_dwc_exit() calls. So, zero these fields after free calls.
Signed-off-by: Vasiliy Kulikov <segoon@openwall.com>
Signed-off-by: Jeff Garzik <jgarzik@pobox.com>
| -rw-r--r-- | drivers/ata/sata_dwc_460ex.c | 21 |
1 files changed, 14 insertions, 7 deletions
diff --git a/drivers/ata/sata_dwc_460ex.c b/drivers/ata/sata_dwc_460ex.c index dc88a39e7db..b02c4ffa4db 100644 --- a/drivers/ata/sata_dwc_460ex.c +++ b/drivers/ata/sata_dwc_460ex.c @@ -766,11 +766,15 @@ static int dma_dwc_xfer_setup(struct scatterlist *sg, int num_elems, static void dma_dwc_exit(struct sata_dwc_device *hsdev) { dev_dbg(host_pvt.dwc_dev, "%s:\n", __func__); - if (host_pvt.sata_dma_regs) + if (host_pvt.sata_dma_regs) { iounmap(host_pvt.sata_dma_regs); + host_pvt.sata_dma_regs = NULL; + } - if (hsdev->irq_dma) + if (hsdev->irq_dma) { free_irq(hsdev->irq_dma, hsdev); + hsdev->irq_dma = 0; + } } /* @@ -1642,7 +1646,7 @@ static int sata_dwc_probe(struct platform_device *ofdev) if (hsdev == NULL) { dev_err(&ofdev->dev, "kmalloc failed for hsdev\n"); err = -ENOMEM; - goto error_out; + goto error; } memset(hsdev, 0, sizeof(*hsdev)); @@ -1652,7 +1656,7 @@ static int sata_dwc_probe(struct platform_device *ofdev) dev_err(&ofdev->dev, "ioremap failed for SATA register" " address\n"); err = -ENODEV; - goto error_out; + goto error_kmalloc; } hsdev->reg_base = base; dev_dbg(&ofdev->dev, "ioremap done for SATA register address\n"); @@ -1665,7 +1669,7 @@ static int sata_dwc_probe(struct platform_device *ofdev) if (!host) { dev_err(&ofdev->dev, "ata_host_alloc_pinfo failed\n"); err = -ENOMEM; - goto error_out; + goto error_iomap; } host->private_data = hsdev; @@ -1733,8 +1737,11 @@ error_out: /* Free SATA DMA resources */ dma_dwc_exit(hsdev); - if (base) - iounmap(base); +error_iomap: + iounmap(base); +error_kmalloc: + kfree(hsdev); +error: return err; } |