Unverified Commit 92d58e89 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!8707 regmap: Fix possible double-free in regcache_rbtree_exit() 

Merge Pull Request from: @ci-robot 
 
PR sync from: dinglongwei <dinglongwei1@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/MWYRYHNXBKU4JUEIHJLUA3P2WIXJLMD2/ 
 
https://gitee.com/src-openeuler/kernel/issues/I9RD9Z 
 
Link:https://gitee.com/openeuler/kernel/pulls/8707

 

Reviewed-by: default avatarWeilong Chen <chenweilong@huawei.com>
Reviewed-by: default avatarLiu YongQiang <liuyongqiang13@huawei.com>
Signed-off-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
parents a3fd864c bd11f92c

drivers/base/regmap/regcache-rbtree.c

+3 −4
Original line number Diff line number Diff line
@@ -295,14 +295,14 @@ static int regcache_rbtree_insert_to_block(struct regmap *map, 
	if (!blk)

		return -ENOMEM;



	rbnode->block = blk;



	if (BITS_TO_LONGS(blklen) > BITS_TO_LONGS(rbnode->blklen)) {

		present = krealloc(rbnode->cache_present,

				   BITS_TO_LONGS(blklen) * sizeof(*present),

				   map->alloc_flags);

		if (!present) {

			kfree(blk);

		if (!present)

			return -ENOMEM;

		}



		memset(present + BITS_TO_LONGS(rbnode->blklen), 0,

		       (BITS_TO_LONGS(blklen) - BITS_TO_LONGS(rbnode->blklen))
@@ -319,7 +319,6 @@ static int regcache_rbtree_insert_to_block(struct regmap *map, 
	}



	/* update the rbnode block, its size and the base register */

	rbnode->block = blk;

	rbnode->blklen = blklen;

	rbnode->base_reg = base_reg;

	rbnode->cache_present = present;