From 3a22addaefc7d50305dd0a7f07e03f6fa9b5cca6 Mon Sep 17 00:00:00 2001 From: Rasmus Villemoes Date: Mon, 8 Feb 2016 22:04:29 +0100 Subject: [PATCH] UPSTREAM: nvmem: core: fix error path in nvmem_add_cells() The current code fails to nvmem_cell_drop(cells[0]) - even worse, if the loop above fails already at i==0, we'll enter an essentially infinite loop doing nvmem_cell_drop on cells[-1], cells[-2], ... which is unlikely to end well. Also, we're not freeing the temporary backing array cells on the error path. Change-Id: I1029a520e86f2c2fd2ad9054037c86b129dde172 Signed-off-by: Rasmus Villemoes Signed-off-by: Greg Kroah-Hartman Signed-off-by: Finley Xiao (cherry pick from dfdf141429f0895b63c882facc42c86f225033cb) --- drivers/nvmem/core.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c index 9d11d9837312..de14fae6f7f6 100644 --- a/drivers/nvmem/core.c +++ b/drivers/nvmem/core.c @@ -294,9 +294,11 @@ static int nvmem_add_cells(struct nvmem_device *nvmem, return 0; err: - while (--i) + while (i--) nvmem_cell_drop(cells[i]); + kfree(cells); + return rval; } -- 2.34.1