mtd: phram: fix a double free issue in error path

commit 49c64df880570034308e4a9a49c4bc95cf8cdb33 upstream.

The variable 'name' is released multiple times in the error path,
which may cause double free issues.
This problem is avoided by adding a goto label to release the memory
uniformly. And this change also makes the code a bit more cleaner.

Fixes: 4f678a58d335 ("mtd: fix memory leaks in phram_setup")
Signed-off-by: Wen Yang <wenyang@linux.alibaba.com>
Cc: Joern Engel <joern@lazybastard.org>
Cc: Miquel Raynal <miquel.raynal@bootlin.com>
Cc: Richard Weinberger <richard@nod.at>
Cc: Vignesh Raghavendra <vigneshr@ti.com>
Cc: linux-mtd@lists.infradead.org
Cc: linux-kernel@vger.kernel.org
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20200318153156.25612-1-wenyang@linux.alibaba.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/mtd/devices/phram.c b/drivers/mtd/devices/phram.c
index 931e5c2..b50ec7e 100644 (file)
--- a/drivers/mtd/devices/phram.c
+++ b/drivers/mtd/devices/phram.c
@@ -243,22 +243,25 @@ static int phram_setup(const char *val)
 
        ret = parse_num64(&start, token[1]);
        if (ret) {
-               kfree(name);
                parse_err("illegal start address\n");
+               goto error;
        }
 
        ret = parse_num64(&len, token[2]);
        if (ret) {
-               kfree(name);
                parse_err("illegal device length\n");
+               goto error;
        }
 
        ret = register_device(name, start, len);
-       if (!ret)
-               pr_info("%s device: %#llx at %#llx\n", name, len, start);
-       else
-               kfree(name);
+       if (ret)
+               goto error;
+
+       pr_info("%s device: %#llx at %#llx\n", name, len, start);
+       return 0;
 
+error:
+       kfree(name);
        return ret;
 }