linux-mtd.lists.infradead.org archive mirror
 help / color / mirror / Atom feed
* [PATCH 1/5] mtd: m25p80: fix allocation size
@ 2013-10-24  2:58 Brian Norris
  2013-10-24  2:58 ` [PATCH 2/5] mtd: m25p80: remove obsolete FIXME Brian Norris
                   ` (6 more replies)
  0 siblings, 7 replies; 30+ messages in thread
From: Brian Norris @ 2013-10-24  2:58 UTC (permalink / raw)
  To: linux-mtd
  Cc: Marek Vasut, sourav.poddar, Brian Norris, stable,
	Artem Bityutskiy

This patch fixes two memory errors:

1. During a probe failure (in mtd_device_parse_register?) the command
   buffer would not be freed.

2. The command buffer's size is determined based on the 'fast_read'
   boolean, but the assignment of fast_read is made after this
   allocation. Thus, the buffer may be allocated "too small".

To fix the first, just switch to the devres version of kzalloc.

To fix the second, increase MAX_CMD_SIZE unconditionally. It's not worth
saving a byte to fiddle around with the conditions here.

This problem was reported by Yuhang Wang a while back.

Signed-off-by: Brian Norris <computersforpeace@gmail.com>
Reported-by: Yuhang Wang <wangyuhang2014@gmail.com>
Cc: <stable@vger.kernel.org>
---
 drivers/mtd/devices/m25p80.c | 20 +++++++-------------
 1 file changed, 7 insertions(+), 13 deletions(-)

diff --git a/drivers/mtd/devices/m25p80.c b/drivers/mtd/devices/m25p80.c
index 8d6c87be..63a95ac 100644
--- a/drivers/mtd/devices/m25p80.c
+++ b/drivers/mtd/devices/m25p80.c
@@ -78,7 +78,7 @@
 
 /* Define max times to check status register before we give up. */
 #define	MAX_READY_WAIT_JIFFIES	(40 * HZ)	/* M25P16 specs 40s max chip erase */
-#define	MAX_CMD_SIZE		5
+#define	MAX_CMD_SIZE		6
 
 #define JEDEC_MFR(_jedec_id)	((_jedec_id) >> 16)
 
@@ -996,15 +996,13 @@ static int m25p_probe(struct spi_device *spi)
 		}
 	}
 
-	flash = kzalloc(sizeof *flash, GFP_KERNEL);
+	flash = devm_kzalloc(&spi->dev, sizeof(*flash), GFP_KERNEL);
 	if (!flash)
 		return -ENOMEM;
-	flash->command = kmalloc(MAX_CMD_SIZE + (flash->fast_read ? 1 : 0),
-					GFP_KERNEL);
-	if (!flash->command) {
-		kfree(flash);
+
+	flash->command = devm_kzalloc(&spi->dev, MAX_CMD_SIZE, GFP_KERNEL);
+	if (!flash->command)
 		return -ENOMEM;
-	}
 
 	flash->spi = spi;
 	mutex_init(&flash->lock);
@@ -1137,14 +1135,10 @@ static int m25p_probe(struct spi_device *spi)
 static int m25p_remove(struct spi_device *spi)
 {
 	struct m25p	*flash = spi_get_drvdata(spi);
-	int		status;
 
 	/* Clean up MTD stuff. */
-	status = mtd_device_unregister(&flash->mtd);
-	if (status == 0) {
-		kfree(flash->command);
-		kfree(flash);
-	}
+	mtd_device_unregister(&flash->mtd);
+
 	return 0;
 }
 
-- 
1.8.4

^ permalink raw reply related	[flat|nested] 30+ messages in thread

end of thread, other threads:[~2013-11-05 13:14 UTC | newest]

Thread overview: 30+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-10-24  2:58 [PATCH 1/5] mtd: m25p80: fix allocation size Brian Norris
2013-10-24  2:58 ` [PATCH 2/5] mtd: m25p80: remove obsolete FIXME Brian Norris
2013-10-24  9:01   ` Sourav Poddar
2013-10-27 16:30   ` Marek Vasut
2013-10-24  2:58 ` [PATCH 3/5] mtd: m25p80: re-align ID entries Brian Norris
2013-10-24  9:01   ` Sourav Poddar
2013-10-24  2:58 ` [PATCH 4/5] mtd: m25p80: remove M25PXX_USE_FAST_READ Kconfig Brian Norris
2013-10-24  9:07   ` Sourav Poddar
2013-10-24  9:12     ` Sourav Poddar
2013-10-24 17:39       ` Brian Norris
2013-10-24 18:48         ` Sourav Poddar
2013-10-25 17:59   ` Brian Norris
2013-10-27 16:32   ` Marek Vasut
2013-10-30 23:38     ` Brian Norris
2013-10-31  9:21       ` Marek Vasut
2013-10-31  9:50         ` Sourav Poddar
2013-10-31 14:55         ` Brian Norris
2013-11-01 12:26           ` Marek Vasut
2013-11-05  3:37             ` Brian Norris
2013-11-05 13:14               ` Marek Vasut
2013-10-24  2:58 ` [PATCH 5/5] mtd: m25p80: remove 'disabled' device check Brian Norris
2013-10-24  9:01   ` Sourav Poddar
2013-10-25  0:15   ` Grant Likely
2013-10-25 18:01   ` Brian Norris
2013-10-24  9:00 ` [PATCH 1/5] mtd: m25p80: fix allocation size Sourav Poddar
2013-10-24 17:17 ` Brian Norris
2013-10-24 17:56   ` Sourav Poddar
2013-10-27 16:30 ` Marek Vasut
2013-10-27 22:48   ` Brian Norris
2013-10-28  7:54     ` Marek Vasut

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).