UBI: fix error handling in ubi_scan()
Two bad things can happen in ubi_scan(): 1. If kmem_cache_create() fails we jump to out_si and call ubi_scan_destroy_si() which calls kmem_cache_destroy(). But si->scan_leb_slab is NULL. 2. If process_eb() fails we jump to out_vidh, call kmem_cache_destroy() and ubi_scan_destroy_si() which calls again kmem_cache_destroy(). Signed-off-by: Richard Weinberger <richard@nod.at> Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com> Cc: stable@kernel.org
This commit is contained in:
parent
6b21d18ed5
commit
a29852be49
|
@ -1174,7 +1174,7 @@ struct ubi_scan_info *ubi_scan(struct ubi_device *ubi)
|
|||
|
||||
ech = kzalloc(ubi->ec_hdr_alsize, GFP_KERNEL);
|
||||
if (!ech)
|
||||
goto out_slab;
|
||||
goto out_si;
|
||||
|
||||
vidh = ubi_zalloc_vid_hdr(ubi, GFP_KERNEL);
|
||||
if (!vidh)
|
||||
|
@ -1235,8 +1235,6 @@ out_vidh:
|
|||
ubi_free_vid_hdr(ubi, vidh);
|
||||
out_ech:
|
||||
kfree(ech);
|
||||
out_slab:
|
||||
kmem_cache_destroy(si->scan_leb_slab);
|
||||
out_si:
|
||||
ubi_scan_destroy_si(si);
|
||||
return ERR_PTR(err);
|
||||
|
@ -1325,7 +1323,9 @@ void ubi_scan_destroy_si(struct ubi_scan_info *si)
|
|||
}
|
||||
}
|
||||
|
||||
kmem_cache_destroy(si->scan_leb_slab);
|
||||
if (si->scan_leb_slab)
|
||||
kmem_cache_destroy(si->scan_leb_slab);
|
||||
|
||||
kfree(si);
|
||||
}
|
||||
|
||||
|
|
Loading…
Reference in a new issue