mtd: phram: fix a double free issue in error path

commit 49c64df880570034308e4a9a49c4bc95cf8cdb33 upstream.

The variable 'name' is released multiple times in the error path,
which may cause double free issues.
This problem is avoided by adding a goto label to release the memory
uniformly. And this change also makes the code a bit more cleaner.

Fixes: 4f678a58d335 ("mtd: fix memory leaks in phram_setup")
Signed-off-by: Wen Yang <wenyang@linux.alibaba.com>
Cc: Joern Engel <joern@lazybastard.org>
Cc: Miquel Raynal <miquel.raynal@bootlin.com>
Cc: Richard Weinberger <richard@nod.at>
Cc: Vignesh Raghavendra <vigneshr@ti.com>
Cc: linux-mtd@lists.infradead.org
Cc: linux-kernel@vger.kernel.org
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20200318153156.25612-1-wenyang@linux.alibaba.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/mtd/devices/phram.c b/drivers/mtd/devices/phram.c
index 8b66e52ca3ccb811e818dce496ca6e0fcc7c9ecb..9734e6903fe6f165b3df75dcd0688fc15e0b3e53 100644 (file)
--- a/drivers/mtd/devices/phram.c
+++ b/drivers/mtd/devices/phram.c
@@ -247,22 +247,25 @@ static int phram_setup(const char *val)
 
        ret = parse_num64(&start, token[1]);
        if (ret) {
-               kfree(name);
                parse_err("illegal start address\n");
+               goto error;
        }
 
        ret = parse_num64(&len, token[2]);
        if (ret) {
-               kfree(name);
                parse_err("illegal device length\n");
+               goto error;
        }
 
        ret = register_device(name, start, len);
-       if (!ret)
-               pr_info("%s device: %#llx at %#llx\n", name, len, start);
-       else
-               kfree(name);
+       if (ret)
+               goto error;
+
+       pr_info("%s device: %#llx at %#llx\n", name, len, start);
+       return 0;
 
+error:
+       kfree(name);
        return ret;
 }