Lv Yunlong b1d1f644ed mtd: rawnand: gpmi: Fix a double free in gpmi_nand_init ... [ Upstream commit 076de75de1e53160e9b099f75872c1f9adf41a0b ] If the callee gpmi_alloc_dma_buffer() failed to alloc memory for this->raw_buffer, gpmi_free_dma_buffer() will be called to free this->auxiliary_virt. But this->auxiliary_virt is still a non-NULL and valid ptr. Then gpmi_alloc_dma_buffer() returns err and gpmi_free_dma_buffer() is called again to free this->auxiliary_virt in err_out. This causes a double free. As gpmi_free_dma_buffer() has already called in gpmi_alloc_dma_buffer's error path, so it should return err directly instead of releasing the dma buffer again. Fixes: 4d02423e9a ("mtd: nand: gpmi: Fix gpmi_nand_init() error path") Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn> Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com> Link: https://lore.kernel.org/linux-mtd/20210403060905.5251-1-lyl2019@mail.ustc.edu.cn Signed-off-by: Sasha Levin <sashal@kernel.org>		2021-05-14 09:50:15 +02:00
..
chips
devices
hyperbus
lpddr
maps	mtd: maps: fix error return code of physmap_flash_remove()	2021-05-14 09:50:09 +02:00
nand	mtd: rawnand: gpmi: Fix a double free in gpmi_nand_init	2021-05-14 09:50:15 +02:00
parsers	mtd: parsers: afs: Fix freeing the part name memory in failure	2021-03-04 11:37:45 +01:00
spi-nor	Revert "mtd: spi-nor: macronix: Add support for mx25l51245g"	2021-05-11 14:47:13 +02:00
tests
ubi
ftl.c
inftlcore.c
inftlmount.c
Kconfig
Makefile
mtd_blkdevs.c
mtdblock_ro.c
mtdblock.c
mtdchar.c	mtd: require write permissions for locking and badblock ioctls	2021-05-14 09:50:13 +02:00
mtdconcat.c
mtdcore.c	mtd: Handle possible -EPROBE_DEFER from parse_mtd_partitions()	2021-05-14 09:50:09 +02:00
mtdcore.h
mtdoops.c
mtdpart.c	mtd: don't lock when recursively deleting partitions	2021-05-14 09:50:09 +02:00
mtdpstore.c
mtdsuper.c
mtdswap.c
nftlcore.c
nftlmount.c
rfd_ftl.c
sm_ftl.c
sm_ftl.h
ssfdc.c