diff options
| author | Rasmus Villemoes <linux@rasmusvillemoes.dk> | 2016-02-08 22:04:29 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2016-02-11 19:23:28 -0800 |
| commit | dfdf141429f0895b63c882facc42c86f225033cb (patch) | |
| tree | 576a34af40f311d2b82b1857cb5b016eafd6b874 | |
| parent | 990162f038400bd229685316beea1155be095125 (diff) | |
nvmem: core: fix error path in nvmem_add_cells()
The current code fails to nvmem_cell_drop(cells[0]) - even worse, if
the loop above fails already at i==0, we'll enter an essentially
infinite loop doing nvmem_cell_drop on cells[-1], cells[-2], ... which
is unlikely to end well.
Also, we're not freeing the temporary backing array cells on the error
path.
Signed-off-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | drivers/nvmem/core.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c index 9d11d9837312..de14fae6f7f6 100644 --- a/drivers/nvmem/core.c +++ b/drivers/nvmem/core.c @@ -294,9 +294,11 @@ static int nvmem_add_cells(struct nvmem_device *nvmem, return 0; err: - while (--i) + while (i--) nvmem_cell_drop(cells[i]); + kfree(cells); + return rval; } |