Commit 2f87208e authored by Dan Carpenter's avatar Dan Carpenter Committed by David S. Miller

drivers: net: davinci_cpdma: double free on error

We recently change the kzalloc() to devm_kzalloc() so freeing "ctlr"
here could lead to a double free.

Fixes: e1943128 ('drivers: net: davinci_cpdma: Convert kzalloc() to devm_kzalloc().')
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 8fc908c3
...@@ -285,10 +285,8 @@ struct cpdma_ctlr *cpdma_ctlr_create(struct cpdma_params *params) ...@@ -285,10 +285,8 @@ struct cpdma_ctlr *cpdma_ctlr_create(struct cpdma_params *params)
ctlr->params.desc_hw_addr, ctlr->params.desc_hw_addr,
ctlr->params.desc_mem_size, ctlr->params.desc_mem_size,
ctlr->params.desc_align); ctlr->params.desc_align);
if (!ctlr->pool) { if (!ctlr->pool)
kfree(ctlr);
return NULL; return NULL;
}
if (WARN_ON(ctlr->num_chan > CPDMA_MAX_CHANNELS)) if (WARN_ON(ctlr->num_chan > CPDMA_MAX_CHANNELS))
ctlr->num_chan = CPDMA_MAX_CHANNELS; ctlr->num_chan = CPDMA_MAX_CHANNELS;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment