From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756080AbcBHVEn (ORCPT ); Mon, 8 Feb 2016 16:04:43 -0500 Received: from mail-wm0-f52.google.com ([74.125.82.52]:37675 "EHLO mail-wm0-f52.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755981AbcBHVEl (ORCPT ); Mon, 8 Feb 2016 16:04:41 -0500 From: Rasmus Villemoes To: Srinivas Kandagatla , Maxime Ripard Cc: Greg Kroah-Hartman , Rasmus Villemoes , linux-kernel@vger.kernel.org Subject: [PATCH] nvmem: core: fix error path in nvmem_add_cells() Date: Mon, 8 Feb 2016 22:04:29 +0100 Message-Id: <1454965469-6141-1-git-send-email-linux@rasmusvillemoes.dk> X-Mailer: git-send-email 2.1.4 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org The current code fails to nvmem_cell_drop(cells[0]) - even worse, if the loop above fails already at i==0, we'll enter an essentially infinite loop doing nvmem_cell_drop on cells[-1], cells[-2], ... which is unlikely to end well. Also, we're not freeing the temporary backing array cells on the error path. Signed-off-by: Rasmus Villemoes --- drivers/nvmem/core.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c index 6fd4e5a5ef4a..1e65eccfea83 100644 --- a/drivers/nvmem/core.c +++ b/drivers/nvmem/core.c @@ -288,9 +288,11 @@ static int nvmem_add_cells(struct nvmem_device *nvmem, return 0; err: - while (--i) + while (i--) nvmem_cell_drop(cells[i]); + kfree(cells); + return rval; } -- 2.1.4