[U-Boot] [PATCH 1/2] cmd_nand: fix a memory leak in nand_dump function

[Masahiro Yamada]

If datbuf = memalign(ARCH_DMA_MINALIGN, nand->writesize);
succeeds and
  oobbuf = memalign(ARCH_DMA_MINALIGN, nand->oobsize);
fails, nand_dump function should free databuf.

Signed-off-by: Masahiro Yamada <yamad...@jp.panasonic.com>
---
 common/cmd_nand.c | 23 ++++++++++++++++-------
 1 file changed, 16 insertions(+), 7 deletions(-)

diff --git a/common/cmd_nand.c b/common/cmd_nand.c
index 886212a..a66f569 100644
--- a/common/cmd_nand.c
+++ b/common/cmd_nand.c
@@ -42,6 +42,7 @@ static int nand_dump(nand_info_t *nand, ulong off, int 
only_oob, int repeat)
        int i;
        u_char *datbuf, *oobbuf, *p;
        static loff_t last;
+       int ret = 0;
 
        if (repeat)
                off = last + nand->writesize;
@@ -49,11 +50,17 @@ static int nand_dump(nand_info_t *nand, ulong off, int 
only_oob, int repeat)
        last = off;
 
        datbuf = memalign(ARCH_DMA_MINALIGN, nand->writesize);
-       oobbuf = memalign(ARCH_DMA_MINALIGN, nand->oobsize);
-       if (!datbuf || !oobbuf) {
+       if (!datbuf) {
                puts("No memory for page buffer\n");
                return 1;
        }
+
+       oobbuf = memalign(ARCH_DMA_MINALIGN, nand->oobsize);
+       if (!oobbuf) {
+               puts("No memory for page buffer\n");
+               ret = 1;
+               goto free_dat;
+       }
        off &= ~(nand->writesize - 1);
        loff_t addr = (loff_t) off;
        struct mtd_oob_ops ops;
@@ -66,9 +73,8 @@ static int nand_dump(nand_info_t *nand, ulong off, int 
only_oob, int repeat)
        i = mtd_read_oob(nand, addr, &ops);
        if (i < 0) {
                printf("Error (%d) reading page %08lx\n", i, off);
-               free(datbuf);
-               free(oobbuf);
-               return 1;
+               ret = 1;
+               goto free_all;
        }
        printf("Page %08lx dump:\n", off);
        i = nand->writesize >> 4;
@@ -91,10 +97,13 @@ static int nand_dump(nand_info_t *nand, ulong off, int 
only_oob, int repeat)
                       p[0], p[1], p[2], p[3], p[4], p[5], p[6], p[7]);
                p += 8;
        }
-       free(datbuf);
+
+free_all:
        free(oobbuf);
+free_dat:
+       free(datbuf);
 
-       return 0;
+       return ret;
 }
 
 /* ------------------------------------------------------------------------- */
-- 
1.8.1.2

_______________________________________________
U-Boot mailing list
U-Boot@lists.denx.de
http://lists.denx.de/mailman/listinfo/u-boot