Commit dfdf1414 authored Feb 08, 2016 by Rasmus Villemoes Committed by Greg Kroah-Hartman Feb 11, 2016

nvmem: core: fix error path in nvmem_add_cells()



The current code fails to nvmem_cell_drop(cells[0]) - even worse, if
the loop above fails already at i==0, we'll enter an essentially
infinite loop doing nvmem_cell_drop on cells[-1], cells[-2], ... which
is unlikely to end well.

Also, we're not freeing the temporary backing array cells on the error
path.

Signed-off-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

parent 990162f0

drivers/nvmem/core.c

+3 −1

Original line number	Diff line number	Diff line
		@@ -294,9 +294,11 @@ static int nvmem_add_cells(struct nvmem_device *nvmem,

		return 0;
		err:
		while (--i)
		while (i--)
		nvmem_cell_drop(cells[i]);

		kfree(cells);

		return rval;
		}

Admin message