target/linux/ipq806x/patches-4.4/019-2-nvmem-core-fix-error-path-in-nvmem_add_cells.patch

   1 From dfdf141429f0895b63c882facc42c86f225033cb Mon Sep 17 00:00:00 2001
   2 From: Rasmus Villemoes <linux@rasmusvillemoes.dk>
   3 Date: Mon, 8 Feb 2016 22:04:29 +0100
   4 Subject: nvmem: core: fix error path in nvmem_add_cells()
   5
   6 The current code fails to nvmem_cell_drop(cells[0]) - even worse, if
   7 the loop above fails already at i==0, we'll enter an essentially
   8 infinite loop doing nvmem_cell_drop on cells[-1], cells[-2], ... which
   9 is unlikely to end well.
  10
  11 Also, we're not freeing the temporary backing array cells on the error
  12 path.
  13
  14 Signed-off-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>
  15 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  16 ---
  17  drivers/nvmem/core.c | 4 +++-
  18  1 file changed, 3 insertions(+), 1 deletion(-)
  19
  20 --- a/drivers/nvmem/core.c
  21 +++ b/drivers/nvmem/core.c
  22 @@ -294,9 +294,11 @@ static int nvmem_add_cells(struct nvmem_
  23
  24         return 0;
  25  err:
  26 -       while (--i)
  27 +       while (i--)
  28                 nvmem_cell_drop(cells[i]);
  29
  30 +       kfree(cells);
  31 +
  32         return rval;
  33  }
  34