2013-09-17 01:32:05

by Brian Norris

[permalink] [raw]
Subject: [PATCH] mtd: nand: fix memory leak in ONFI extended parameter page

This fixes a memory leak in the ONFI support code for detecting the
required ECC levels from this commit:

commit 6dcbe0cdd83fb5f77be4f44c9e06c535281c375a
Author: Huang Shijie <[email protected]>
Date: Wed May 22 10:28:27 2013 +0800

mtd: get the ECC info from the Extended Parameter Page

In the success case, we never freed the 'ep' buffer.

Also, this fixes an oversight in the same commit where we (harmlessly)
freed the NULL pointer.

Signed-off-by: Brian Norris <[email protected]>
Cc: Huang Shijie <[email protected]>
---
David, if there are no objections, can you send this to Linus for 3.12?

If this doesn't make it into 3.12, then it will be -stable material.

drivers/mtd/nand/nand_base.c | 8 +++-----
1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c
index d4578a1..00022b4 100644
--- a/drivers/mtd/nand/nand_base.c
+++ b/drivers/mtd/nand/nand_base.c
@@ -2869,10 +2869,8 @@ static int nand_flash_detect_ext_param_page(struct mtd_info *mtd,

len = le16_to_cpu(p->ext_param_page_length) * 16;
ep = kmalloc(len, GFP_KERNEL);
- if (!ep) {
- ret = -ENOMEM;
- goto ext_out;
- }
+ if (!ep)
+ return -ENOMEM;

/* Send our own NAND_CMD_PARAM. */
chip->cmdfunc(mtd, NAND_CMD_PARAM, 0, -1);
@@ -2920,7 +2918,7 @@ static int nand_flash_detect_ext_param_page(struct mtd_info *mtd,
}

pr_info("ONFI extended param page detected.\n");
- return 0;
+ ret = 0;

ext_out:
kfree(ep);
--
1.8.4


2013-09-17 02:11:12

by Huang Shijie

[permalink] [raw]
Subject: Re: [PATCH] mtd: nand: fix memory leak in ONFI extended parameter page

?? 2013??09??17?? 09:31, Brian Norris д??:
> This fixes a memory leak in the ONFI support code for detecting the
> required ECC levels from this commit:
>
> commit 6dcbe0cdd83fb5f77be4f44c9e06c535281c375a
> Author: Huang Shijie <[email protected]>
> Date: Wed May 22 10:28:27 2013 +0800
>
> mtd: get the ECC info from the Extended Parameter Page
>
> In the success case, we never freed the 'ep' buffer.
>
> Also, this fixes an oversight in the same commit where we (harmlessly)
> freed the NULL pointer.
>
> Signed-off-by: Brian Norris <[email protected]>
> Cc: Huang Shijie <[email protected]>
> ---
> David, if there are no objections, can you send this to Linus for 3.12?
>
> If this doesn't make it into 3.12, then it will be -stable material.
>
> drivers/mtd/nand/nand_base.c | 8 +++-----
> 1 file changed, 3 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c
> index d4578a1..00022b4 100644
> --- a/drivers/mtd/nand/nand_base.c
> +++ b/drivers/mtd/nand/nand_base.c
> @@ -2869,10 +2869,8 @@ static int nand_flash_detect_ext_param_page(struct mtd_info *mtd,
>
> len = le16_to_cpu(p->ext_param_page_length) * 16;
> ep = kmalloc(len, GFP_KERNEL);
> - if (!ep) {
> - ret = -ENOMEM;
> - goto ext_out;
> - }
> + if (!ep)
> + return -ENOMEM;
>
> /* Send our own NAND_CMD_PARAM. */
> chip->cmdfunc(mtd, NAND_CMD_PARAM, 0, -1);
> @@ -2920,7 +2918,7 @@ static int nand_flash_detect_ext_param_page(struct mtd_info *mtd,
> }
>
> pr_info("ONFI extended param page detected.\n");
> - return 0;
> + ret = 0;
>
> ext_out:
> kfree(ep);
good catch!

Acked-by: Huang Shijie <[email protected]>

2013-09-19 04:15:46

by Brian Norris

[permalink] [raw]
Subject: Re: [PATCH] mtd: nand: fix memory leak in ONFI extended parameter page

On Tue, Sep 17, 2013 at 10:12:57AM +0800, Huang Shijie wrote:
> 于 2013年09月17日 09:31, Brian Norris 写道:
> > This fixes a memory leak in the ONFI support code for detecting the
> > required ECC levels from this commit:
> >
> > commit 6dcbe0cdd83fb5f77be4f44c9e06c535281c375a
> > Author: Huang Shijie <[email protected]>
> > Date: Wed May 22 10:28:27 2013 +0800
> >
> > mtd: get the ECC info from the Extended Parameter Page
> >
> > In the success case, we never freed the 'ep' buffer.
> >
> > Also, this fixes an oversight in the same commit where we (harmlessly)
> > freed the NULL pointer.
> >
> > Signed-off-by: Brian Norris <[email protected]>
> > Cc: Huang Shijie <[email protected]>
> > ---
> > David, if there are no objections, can you send this to Linus for 3.12?
> >
> > If this doesn't make it into 3.12, then it will be -stable material.
> >
> > drivers/mtd/nand/nand_base.c | 8 +++-----
> > 1 file changed, 3 insertions(+), 5 deletions(-)
> >
> > diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c
> > index d4578a1..00022b4 100644
> > --- a/drivers/mtd/nand/nand_base.c
> > +++ b/drivers/mtd/nand/nand_base.c
> > @@ -2869,10 +2869,8 @@ static int nand_flash_detect_ext_param_page(struct mtd_info *mtd,
> >
> > len = le16_to_cpu(p->ext_param_page_length) * 16;
> > ep = kmalloc(len, GFP_KERNEL);
> > - if (!ep) {
> > - ret = -ENOMEM;
> > - goto ext_out;
> > - }
> > + if (!ep)
> > + return -ENOMEM;
> >
> > /* Send our own NAND_CMD_PARAM. */
> > chip->cmdfunc(mtd, NAND_CMD_PARAM, 0, -1);
> > @@ -2920,7 +2918,7 @@ static int nand_flash_detect_ext_param_page(struct mtd_info *mtd,
> > }
> >
> > pr_info("ONFI extended param page detected.\n");
> > - return 0;
> > + ret = 0;
> >
> > ext_out:
> > kfree(ep);
> good catch!
>
> Acked-by: Huang Shijie <[email protected]>

OK, pushed to l2-mtd.git. If I don't hear anything from David in a few
days, then I'll see about sending it upstream myself. He had time to
respond to your quad-SPI series but not to the pxa3xx compile failures
in his -rc1 pull request.

Brian