提交 04e506b5 编写于 作者: V Vasiliy Kulikov 提交者: Jeff Garzik

sata_dwc_460ex: fix error path

Fixed hsdev memleak on sata_dwc_probe() error.
As dma_dwc_exit() can be called multiple times without sata_dma_regs and
irq_dma changes, it might lead to double free on sequential
dma_dwc_exit() calls.  So, zero these fields after free calls.
Signed-off-by: NVasiliy Kulikov <segoon@openwall.com>
Signed-off-by: NJeff Garzik <jgarzik@pobox.com>
上级 3c4aa91f
...@@ -766,11 +766,15 @@ static int dma_dwc_xfer_setup(struct scatterlist *sg, int num_elems, ...@@ -766,11 +766,15 @@ static int dma_dwc_xfer_setup(struct scatterlist *sg, int num_elems,
static void dma_dwc_exit(struct sata_dwc_device *hsdev) static void dma_dwc_exit(struct sata_dwc_device *hsdev)
{ {
dev_dbg(host_pvt.dwc_dev, "%s:\n", __func__); dev_dbg(host_pvt.dwc_dev, "%s:\n", __func__);
if (host_pvt.sata_dma_regs) if (host_pvt.sata_dma_regs) {
iounmap(host_pvt.sata_dma_regs); iounmap(host_pvt.sata_dma_regs);
host_pvt.sata_dma_regs = NULL;
}
if (hsdev->irq_dma) if (hsdev->irq_dma) {
free_irq(hsdev->irq_dma, hsdev); free_irq(hsdev->irq_dma, hsdev);
hsdev->irq_dma = 0;
}
} }
/* /*
...@@ -1642,7 +1646,7 @@ static int sata_dwc_probe(struct platform_device *ofdev) ...@@ -1642,7 +1646,7 @@ static int sata_dwc_probe(struct platform_device *ofdev)
if (hsdev == NULL) { if (hsdev == NULL) {
dev_err(&ofdev->dev, "kmalloc failed for hsdev\n"); dev_err(&ofdev->dev, "kmalloc failed for hsdev\n");
err = -ENOMEM; err = -ENOMEM;
goto error_out; goto error;
} }
memset(hsdev, 0, sizeof(*hsdev)); memset(hsdev, 0, sizeof(*hsdev));
...@@ -1652,7 +1656,7 @@ static int sata_dwc_probe(struct platform_device *ofdev) ...@@ -1652,7 +1656,7 @@ static int sata_dwc_probe(struct platform_device *ofdev)
dev_err(&ofdev->dev, "ioremap failed for SATA register" dev_err(&ofdev->dev, "ioremap failed for SATA register"
" address\n"); " address\n");
err = -ENODEV; err = -ENODEV;
goto error_out; goto error_kmalloc;
} }
hsdev->reg_base = base; hsdev->reg_base = base;
dev_dbg(&ofdev->dev, "ioremap done for SATA register address\n"); dev_dbg(&ofdev->dev, "ioremap done for SATA register address\n");
...@@ -1665,7 +1669,7 @@ static int sata_dwc_probe(struct platform_device *ofdev) ...@@ -1665,7 +1669,7 @@ static int sata_dwc_probe(struct platform_device *ofdev)
if (!host) { if (!host) {
dev_err(&ofdev->dev, "ata_host_alloc_pinfo failed\n"); dev_err(&ofdev->dev, "ata_host_alloc_pinfo failed\n");
err = -ENOMEM; err = -ENOMEM;
goto error_out; goto error_iomap;
} }
host->private_data = hsdev; host->private_data = hsdev;
...@@ -1733,8 +1737,11 @@ static int sata_dwc_probe(struct platform_device *ofdev) ...@@ -1733,8 +1737,11 @@ static int sata_dwc_probe(struct platform_device *ofdev)
/* Free SATA DMA resources */ /* Free SATA DMA resources */
dma_dwc_exit(hsdev); dma_dwc_exit(hsdev);
if (base) error_iomap:
iounmap(base); iounmap(base);
error_kmalloc:
kfree(hsdev);
error:
return err; return err;
} }
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册