On Sun, 18 Aug 2019 21:46:04 -0500 Wenwen Wang <[email protected]> wrote:
> In nand_scan_bbt(), a temporary buffer 'buf' is allocated through > vmalloc(). However, if check_create() fails, 'buf' is not deallocated, > leading to a memory leak bug. To fix this issue, free 'buf' before > returning the error. > > Signed-off-by: Wenwen Wang <[email protected]> > --- > drivers/mtd/nand/raw/nand_bbt.c | 10 ++++++---- > 1 file changed, 6 insertions(+), 4 deletions(-) > > diff --git a/drivers/mtd/nand/raw/nand_bbt.c b/drivers/mtd/nand/raw/nand_bbt.c > index 2ef15ef..96045d6 100644 > --- a/drivers/mtd/nand/raw/nand_bbt.c > +++ b/drivers/mtd/nand/raw/nand_bbt.c > @@ -1232,7 +1232,7 @@ static int nand_scan_bbt(struct nand_chip *this, struct > nand_bbt_descr *bd) > if (!td) { > if ((res = nand_memory_bbt(this, bd))) { > pr_err("nand_bbt: can't scan flash and build the > RAM-based BBT\n"); > - goto err; > + goto err_free_bbt; > } > return 0; > } > @@ -1245,7 +1245,7 @@ static int nand_scan_bbt(struct nand_chip *this, struct > nand_bbt_descr *bd) > buf = vmalloc(len); > if (!buf) { > res = -ENOMEM; > - goto err; > + goto err_free_bbt; > } > > /* Is the bbt at a given page? */ > @@ -1258,7 +1258,7 @@ static int nand_scan_bbt(struct nand_chip *this, struct > nand_bbt_descr *bd) > > res = check_create(this, buf, bd); I know it's too late, but calling vfree(buf); here > if (res) > - goto err; > + goto err_free_buf; > > /* Prevent the bbt regions from erasing / writing */ > mark_bbt_region(this, td); > @@ -1268,7 +1268,9 @@ static int nand_scan_bbt(struct nand_chip *this, struct > nand_bbt_descr *bd) > vfree(buf); instead of here would have fixed the leak without the need for an extra err label. > return 0; > > -err: > +err_free_buf: > + vfree(buf); > +err_free_bbt: > kfree(this->bbt); > this->bbt = NULL; > return res;
