Skip to content

Commit b70a56d

Browse files
Dan Carpentersmb49
authored andcommitted
mtd: rawnand: fix double free in atmel_pmecc_create_user()
BugLink: https://bugs.launchpad.net/bugs/2101915 commit d8e4771f99c0400a1873235704b28bb803c83d17 upstream. The "user" pointer was converted from being allocated with kzalloc() to being allocated by devm_kzalloc(). Calling kfree(user) will lead to a double free. Fixes: 6d734f1bfc33 ("mtd: rawnand: atmel: Fix possible memory leak") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit dd45c87782738715d5e7c167f8dabf0814a7394a linux-6.6.y) [koichiroden: follow-up fix from v6.6.69] Signed-off-by: Koichiro Den <koichiro.den@canonical.com> Signed-off-by: Stefan Bader <stefan.bader@canonical.com>
1 parent 894f189 commit b70a56d

File tree

1 file changed

+1
-3
lines changed

1 file changed

+1
-3
lines changed

drivers/mtd/nand/raw/atmel/pmecc.c

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -380,10 +380,8 @@ atmel_pmecc_create_user(struct atmel_pmecc *pmecc,
380380
user->delta = user->dmu + req->ecc.strength + 1;
381381

382382
gf_tables = atmel_pmecc_get_gf_tables(req);
383-
if (IS_ERR(gf_tables)) {
384-
kfree(user);
383+
if (IS_ERR(gf_tables))
385384
return ERR_CAST(gf_tables);
386-
}
387385

388386
user->gf_tables = gf_tables;
389387

0 commit comments

Comments
 (0)