Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
From:   Miquel Raynal <miquel.raynal@bootlin.com>
To:     Lv Yunlong <lyl2019@mail.ustc.edu.cn>, han.xu@nxp.com,
        miquel.raynal@bootlin.com, richard@nod.at, vigneshr@ti.com,
        bbrezillon@kernel.org
Cc:     linux-mtd@lists.infradead.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH] mtd: nand: gpmi: Fix a double free in gpmi_nand_init
Date:   Wed,  7 Apr 2021 11:06:33 +0200
Message-Id: <20210407090633.45393-1-miquel.raynal@bootlin.com>
In-Reply-To: <20210403060905.5251-1-lyl2019@mail.ustc.edu.cn>
References: 
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Precedence: bulk

On Sat, 2021-04-03 at 06:09:05 UTC, Lv Yunlong wrote:
> If the callee gpmi_alloc_dma_buffer() failed to alloc memory for
> this->raw_buffer, gpmi_free_dma_buffer() will be called to free
> this->auxiliary_virt. But this->auxiliary_virt is still a non-NULL
> and valid ptr.
> 
> Then gpmi_alloc_dma_buffer() returns err and gpmi_free_dma_buffer()
> is called again to free this->auxiliary_virt in err_out. This causes
> a double free.
> 
> As gpmi_free_dma_buffer() has already called in gpmi_alloc_dma_buffer's
> error path, so it should return err directly instead of releasing the dma
> buffer again.
> 
> Fixes: 4d02423e9afe6 ("mtd: nand: gpmi: Fix gpmi_nand_init() error path")
> Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>

Applied to https://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux.git nand/next, thanks.

Miquel