moonjuice/kernel_arpi
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge tag 'regmap-fix-v5.15-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap

Browse Source 
Pull regmap fix from Mark Brown:
 "This fixes a potential double free when handling an out of memory
  error inserting a node into an rbtree regcache"

* tag 'regmap-fix-v5.15-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap:
  regmap: Fix possible double-free in regcache_rbtree_exit()
This commit is contained in:
Linus Torvalds
2021-10-28 10:00:58 -07:00
parent eecd231a80 55e6d80378
commit 8685de2ed8
1 changed files with 3 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
drivers/base/regmap/regcache-rbtree.c
View File

@@ -281,14 +281,14 @@ static int regcache_rbtree_insert_to_block(struct regmap *map,
if (!blk) if (!blk)
return -ENOMEM; return -ENOMEM;
rbnode->block = blk;
if (BITS_TO_LONGS(blklen) > BITS_TO_LONGS(rbnode->blklen)) { if (BITS_TO_LONGS(blklen) > BITS_TO_LONGS(rbnode->blklen)) {
present = krealloc(rbnode->cache_present, present = krealloc(rbnode->cache_present,
BITS_TO_LONGS(blklen) * sizeof(*present), BITS_TO_LONGS(blklen) * sizeof(*present),
GFP_KERNEL); GFP_KERNEL);
if (!present) { if (!present)
kfree(blk);
return -ENOMEM; return -ENOMEM;
}
memset(present + BITS_TO_LONGS(rbnode->blklen), 0, memset(present + BITS_TO_LONGS(rbnode->blklen), 0,
(BITS_TO_LONGS(blklen) - BITS_TO_LONGS(rbnode->blklen)) (BITS_TO_LONGS(blklen) - BITS_TO_LONGS(rbnode->blklen))
@@ -305,7 +305,6 @@ static int regcache_rbtree_insert_to_block(struct regmap *map,
} }
/* update the rbnode block, its size and the base register */ /* update the rbnode block, its size and the base register */
rbnode->block = blk;
rbnode->blklen = blklen; rbnode->blklen = blklen;
rbnode->base_reg = base_reg; rbnode->base_reg = base_reg;
rbnode->cache_present = present; rbnode->cache_present = present;