Patchwork MTD: FTL layer: don't free input argument in add_mtd_blktrans_dev

login
register
mail settings
Submitter Maxim Levitsky
Date Jan. 8, 2011, 11:25 p.m.
Message ID <1294529106-32586-1-git-send-email-maximlevitsky@gmail.com>
Download mbox | patch
Permalink /patch/77992/
State New
Headers show

Comments

Maxim Levitsky - Jan. 8, 2011, 11:25 p.m.
This one liner patch fixes double free that will occur if add_mtd_blktrans_dev
fails. On failure it free input argument, but all its users
also free it on error which is natural thing to do.
Thus don't free it.

All credit for finding that bug belongs to reporters of the bug in the android bugzilla
http://code.google.com/p/android/issues/detail?id=13761

Signed-of-by: Maxim Levitsky <maximlevitsky@gmail.com>
CC: nnk@google.com
CC: enh@google.com
---
 drivers/mtd/mtd_blkdevs.c |    1 -
 1 files changed, 0 insertions(+), 1 deletions(-)
Artem Bityutskiy - Jan. 18, 2011, 8:32 a.m.
On Sun, 2011-01-09 at 01:25 +0200, Maxim Levitsky wrote:
> This one liner patch fixes double free that will occur if add_mtd_blktrans_dev
> fails. On failure it free input argument, but all its users
> also free it on error which is natural thing to do.
> Thus don't free it.
> 
> All credit for finding that bug belongs to reporters of the bug in the android bugzilla
> http://code.google.com/p/android/issues/detail?id=13761
> 
> Signed-of-by: Maxim Levitsky <maximlevitsky@gmail.com>

Signed-off-by, (off, not of). I'll fix this.

I'll change your subject line to:

mtd: mtd_blkdevs: fix double free on error path

a) We use "mtd:" prefix, not "MTD:".
b). mtd_blkdevs is not really an FTL layer, I think.
c). The subject line has to make it obvious whether this is a bugfix or
something else - it makes life of people who look at commit messages ans
search for stuff important stuff easier. Your subject line is
technically correct, but not very helpful.

Anyway, picked to l2-mtd-2.6.git, thanks!

Patch

diff --git a/drivers/mtd/mtd_blkdevs.c b/drivers/mtd/mtd_blkdevs.c
index cb20c67..e0a2373 100644
--- a/drivers/mtd/mtd_blkdevs.c
+++ b/drivers/mtd/mtd_blkdevs.c
@@ -413,7 +413,6 @@  error3:
 error2:
 	list_del(&new->list);
 error1:
-	kfree(new);
 	return ret;
 }