瀏覽代碼

UBI: fix double free on error path

If we fail in 'ubi_eba_init_scan()', we free
'ubi->volumes[i]->eba_tbl' in there, but also later free it
in 'free_internal_volumes()'. Fix this by assigning NULL
to 'ubi->volumes[i]->eba_tbl' after it is freed.

Signed-off-by: Adrian Hunter <adrian.hunter@nokia.com>
Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
Adrian Hunter 16 年之前
父節點
當前提交
7194e6f9c0
共有 1 個文件被更改,包括 1 次插入0 次删除
  1. 1 0
      drivers/mtd/ubi/eba.c

+ 1 - 0
drivers/mtd/ubi/eba.c

@@ -1254,6 +1254,7 @@ out_free:
 		if (!ubi->volumes[i])
 			continue;
 		kfree(ubi->volumes[i]->eba_tbl);
+		ubi->volumes[i]->eba_tbl = NULL;
 	}
 	return err;
 }