Messages in this thread | | | From | Miquel Raynal <> | Subject | Re: [PATCH] mtd: rawnand: diskonchip: fix a potential double free in doc_probe | Date | Fri, 15 Dec 2023 11:59:14 +0100 |
| |
On Thu, 2023-12-14 at 07:29:43 UTC, Dinghao Liu wrote: > When nand_scan() fails, it has cleaned up related resources > in its error paths. Therefore, the following nand_cleanup() > may lead to a double-free. One possible trace is: > > doc_probe > |-> nand_scan > | |-> nand_scan_with_ids > | |-> nand_scan_tail > | |-> kfree(chip->data_buf) [First free] > | > |-> nand_cleanup > |-> kfree(chip->data_buf) [Double free here] > > Fix this by removing nand_cleanup() on failure of > nand_scan(). > > Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
Applied to https://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux.git nand/next, thanks.
Miquel
| |