Commit 8685de2e authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'regmap-fix-v5.15-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap 

Pull regmap fix from Mark Brown:
 "This fixes a potential double free when handling an out of memory
  error inserting a node into an rbtree regcache"

* tag 'regmap-fix-v5.15-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap:
  regmap: Fix possible double-free in regcache_rbtree_exit()
parents eecd231a 55e6d803

drivers/base/regmap/regcache-rbtree.c

+3 −4
Original line number Diff line number Diff line
@@ -281,14 +281,14 @@ static int regcache_rbtree_insert_to_block(struct regmap *map, 
	if (!blk)

		return -ENOMEM;



	rbnode->block = blk;



	if (BITS_TO_LONGS(blklen) > BITS_TO_LONGS(rbnode->blklen)) {

		present = krealloc(rbnode->cache_present,

				   BITS_TO_LONGS(blklen) * sizeof(*present),

				   GFP_KERNEL);

		if (!present) {

			kfree(blk);

		if (!present)

			return -ENOMEM;

		}



		memset(present + BITS_TO_LONGS(rbnode->blklen), 0,

		       (BITS_TO_LONGS(blklen) - BITS_TO_LONGS(rbnode->blklen))
@@ -305,7 +305,6 @@ static int regcache_rbtree_insert_to_block(struct regmap *map, 
	}



	/* update the rbnode block, its size and the base register */

	rbnode->block = blk;

	rbnode->blklen = blklen;

	rbnode->base_reg = base_reg;

	rbnode->cache_present = present;