diff options
| author | Jay Fang <f.fangjian@huawei.com> | 2021-05-06 15:08:08 +0800 |
|---|---|---|
| committer | Mark Brown <broonie@kernel.org> | 2021-05-10 13:17:16 +0100 |
| commit | 026a1dc1af52742c5897e64a3431445371a71871 (patch) | |
| tree | e10117665b9daaeeb4466dc749f10c57346ec528 /drivers/spi | |
| parent | ccef8441fb2d352fa982f6607f471cdd17b30741 (diff) | |
spi: spi-topcliff-pch: Fix potential double free in pch_spi_process_messages()
pch_spi_set_tx() frees data->pkt_tx_buff on failure of kzalloc() for
data->pkt_rx_buff, but its caller, pch_spi_process_messages(), will
free data->pkt_tx_buff again. Set data->pkt_tx_buff to NULL after
kfree() to avoid double free.
Signed-off-by: Jay Fang <f.fangjian@huawei.com>
Link: https://lore.kernel.org/r/1620284888-65215-1-git-send-email-f.fangjian@huawei.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Diffstat (limited to 'drivers/spi')
| -rw-r--r-- | drivers/spi/spi-topcliff-pch.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/drivers/spi/spi-topcliff-pch.c b/drivers/spi/spi-topcliff-pch.c index b8870784fc6e..8c4615b76339 100644 --- a/drivers/spi/spi-topcliff-pch.c +++ b/drivers/spi/spi-topcliff-pch.c @@ -580,8 +580,10 @@ static void pch_spi_set_tx(struct pch_spi_data *data, int *bpw) data->pkt_tx_buff = kzalloc(size, GFP_KERNEL); if (data->pkt_tx_buff != NULL) { data->pkt_rx_buff = kzalloc(size, GFP_KERNEL); - if (!data->pkt_rx_buff) + if (!data->pkt_rx_buff) { kfree(data->pkt_tx_buff); + data->pkt_tx_buff = NULL; + } } if (!data->pkt_rx_buff) { |