[PATCH] memstick: ms_block: fix double free in msb_ftl_initialize() error path

[PATCH] memstick: ms_block: fix double free in msb_ftl_initialize() error path

[Thomas Fourier]

When one of the allocations in msb_ftl_initialize() fails, the function
frees msb->used_blocks_bitmap, msb->erased_blocks_bitmap and
msb->lba_to_pba_table but leaves the pointers set. The caller
msb_init_card() fails and both of its callers (msb_probe() and
msb_resume()) call msb_data_clear(), which frees the same three pointers
again.

Do not free them in msb_ftl_initialize().

This bug was found statically and is theoretical.

Signed-off-by: Thomas Fourier <fourier.thomas@gmail.com>
Fixes: 0ab30494bc4f ("memstick: add support for legacy memorysticks")
---
 drivers/memstick/core/ms_block.c | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/drivers/memstick/core/ms_block.c b/drivers/memstick/core/ms_block.c
index cd4ff1b79a6d..26a04cecd94b 100644
--- a/drivers/memstick/core/ms_block.c
+++ b/drivers/memstick/core/ms_block.c
@@ -1351,12 +1351,8 @@ static int msb_ftl_initialize(struct msb_data *msb)
 			      GFP_KERNEL);
 
 	if (!msb->used_blocks_bitmap || !msb->lba_to_pba_table ||
-						!msb->erased_blocks_bitmap) {
-		bitmap_free(msb->used_blocks_bitmap);
-		bitmap_free(msb->erased_blocks_bitmap);
-		kfree(msb->lba_to_pba_table);
+						!msb->erased_blocks_bitmap)
 		return -ENOMEM;
-	}
 
 	for (i = 0; i < msb->zone_count; i++)
 		msb->free_block_count[i] = MS_BLOCKS_IN_ZONE;
-- 
2.53.0