summaryrefslogtreecommitdiffstats
path: root/drivers/mtd/devices
diff options
context:
space:
mode:
authorH Hartley Sweeten <hartleys@visionengravers.com>2009-10-07 17:08:08 -0400
committerDavid Woodhouse <David.Woodhouse@intel.com>2009-10-17 15:41:11 +0100
commitd4702669b0b64b8fa7c91123639ec20d9592ee43 (patch)
treea5f0be652b0a21b52194814de874a91d5cbe0358 /drivers/mtd/devices
parentf54d6336372b97d3624d1c5c179b2dd062472bd1 (diff)
mtd: fix memory leak in mtd_dataflash
Fix a potential memory leak in mtd_dataflash driver. The private data that is allocated when registering a DataFlash device with the MTD subsystem is not released if an error occurs when add_mtd_partitions() or add_mtd_device() is called. Fix this by adding an error path. The memory is already released during a remove. Also, add a dev_set_drvdata(&spi->dev, NULL) before the kfree() so that the spi device does not reference invalid data. Signed-off-by: H Hartley Sweeten <hsweeten@visionengravers.com> Cc: David Brownell <david-b@pacbell.net> Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com> Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Diffstat (limited to 'drivers/mtd/devices')
-rw-r--r--drivers/mtd/devices/mtd_dataflash.c19
1 files changed, 16 insertions, 3 deletions
diff --git a/drivers/mtd/devices/mtd_dataflash.c b/drivers/mtd/devices/mtd_dataflash.c
index 93e3627be74..19817404ce7 100644
--- a/drivers/mtd/devices/mtd_dataflash.c
+++ b/drivers/mtd/devices/mtd_dataflash.c
@@ -636,6 +636,7 @@ add_dataflash_otp(struct spi_device *spi, char *name,
struct mtd_info *device;
struct flash_platform_data *pdata = spi->dev.platform_data;
char *otp_tag = "";
+ int err = 0;
priv = kzalloc(sizeof *priv, GFP_KERNEL);
if (!priv)
@@ -693,13 +694,23 @@ add_dataflash_otp(struct spi_device *spi, char *name,
if (nr_parts > 0) {
priv->partitioned = 1;
- return add_mtd_partitions(device, parts, nr_parts);
+ err = add_mtd_partitions(device, parts, nr_parts);
+ goto out;
}
} else if (pdata && pdata->nr_parts)
dev_warn(&spi->dev, "ignoring %d default partitions on %s\n",
pdata->nr_parts, device->name);
- return add_mtd_device(device) == 1 ? -ENODEV : 0;
+ if (add_mtd_device(device) == 1)
+ err = -ENODEV;
+
+out:
+ if (!err)
+ return 0;
+
+ dev_set_drvdata(&spi->dev, NULL);
+ kfree(priv);
+ return err;
}
static inline int __devinit
@@ -932,8 +943,10 @@ static int __devexit dataflash_remove(struct spi_device *spi)
status = del_mtd_partitions(&flash->mtd);
else
status = del_mtd_device(&flash->mtd);
- if (status == 0)
+ if (status == 0) {
+ dev_set_drvdata(&spi->dev, NULL);
kfree(flash);
+ }
return status;
}