UBI: fix double free on error path
authorAdrian Hunter <Adrian.Hunter@nokia.com>
Fri, 24 Jul 2009 14:05:00 +0000 (17:05 +0300)
committerArtem Bityutskiy <Artem.Bityutskiy@nokia.com>
Fri, 24 Jul 2009 17:08:52 +0000 (20:08 +0300)
If we fail in 'ubi_eba_init_scan()', we free
'ubi->volumes[i]->eba_tbl' in there, but also later free it
in 'free_internal_volumes()'. Fix this by assigning NULL
to 'ubi->volumes[i]->eba_tbl' after it is freed.

Signed-off-by: Adrian Hunter <adrian.hunter@nokia.com>
Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
drivers/mtd/ubi/eba.c

index 0f2034c3ed2f715b4281522aeed820023b9f8f14..e4d9ef0c965a4f432a45913942f03d7702a7b4cb 100644 (file)
@@ -1254,6 +1254,7 @@ out_free:
                if (!ubi->volumes[i])
                        continue;
                kfree(ubi->volumes[i]->eba_tbl);
+               ubi->volumes[i]->eba_tbl = NULL;
        }
        return err;
 }