diff options
| author | H Hartley Sweeten <hartleys@visionengravers.com> | 2009-10-07 17:08:08 -0400 |
|---|---|---|
| committer | David Woodhouse <David.Woodhouse@intel.com> | 2009-10-17 15:41:11 +0100 |
| commit | d4702669b0b64b8fa7c91123639ec20d9592ee43 (patch) | |
| tree | a5f0be652b0a21b52194814de874a91d5cbe0358 /drivers/mtd/devices | |
| parent | f54d6336372b97d3624d1c5c179b2dd062472bd1 (diff) | |
mtd: fix memory leak in mtd_dataflash
Fix a potential memory leak in mtd_dataflash driver.
The private data that is allocated when registering a DataFlash
device with the MTD subsystem is not released if an error occurs
when add_mtd_partitions() or add_mtd_device() is called. Fix this
by adding an error path. The memory is already released during a
remove.
Also, add a dev_set_drvdata(&spi->dev, NULL) before the kfree() so
that the spi device does not reference invalid data.
Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com>
Cc: David Brownell <david-b@pacbell.net>
Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Diffstat (limited to 'drivers/mtd/devices')
| -rw-r--r-- | drivers/mtd/devices/mtd_dataflash.c | 19 |
1 files changed, 16 insertions, 3 deletions
diff --git a/drivers/mtd/devices/mtd_dataflash.c b/drivers/mtd/devices/mtd_dataflash.c index 93e3627be74..19817404ce7 100644 --- a/drivers/mtd/devices/mtd_dataflash.c +++ b/drivers/mtd/devices/mtd_dataflash.c @@ -636,6 +636,7 @@ add_dataflash_otp(struct spi_device *spi, char *name, struct mtd_info *device; struct flash_platform_data *pdata = spi->dev.platform_data; char *otp_tag = ""; + int err = 0; priv = kzalloc(sizeof *priv, GFP_KERNEL); if (!priv) @@ -693,13 +694,23 @@ add_dataflash_otp(struct spi_device *spi, char *name, if (nr_parts > 0) { priv->partitioned = 1; - return add_mtd_partitions(device, parts, nr_parts); + err = add_mtd_partitions(device, parts, nr_parts); + goto out; } } else if (pdata && pdata->nr_parts) dev_warn(&spi->dev, "ignoring %d default partitions on %s\n", pdata->nr_parts, device->name); - return add_mtd_device(device) == 1 ? -ENODEV : 0; + if (add_mtd_device(device) == 1) + err = -ENODEV; + +out: + if (!err) + return 0; + + dev_set_drvdata(&spi->dev, NULL); + kfree(priv); + return err; } static inline int __devinit @@ -932,8 +943,10 @@ static int __devexit dataflash_remove(struct spi_device *spi) status = del_mtd_partitions(&flash->mtd); else status = del_mtd_device(&flash->mtd); - if (status == 0) + if (status == 0) { + dev_set_drvdata(&spi->dev, NULL); kfree(flash); + } return status; } |