sata_dwc_460ex: fix error path

Fixed hsdev memleak on sata_dwc_probe() error.
As dma_dwc_exit() can be called multiple times without sata_dma_regs and
irq_dma changes, it might lead to double free on sequential
dma_dwc_exit() calls.  So, zero these fields after free calls.

Signed-off-by: Vasiliy Kulikov <segoon@openwall.com>
Signed-off-by: Jeff Garzik <jgarzik@pobox.com>

diff --git a/drivers/ata/sata_dwc_460ex.c b/drivers/ata/sata_dwc_460ex.c
index dc88a39e7db8b04c9a2ec3e85ed888ee90194e69..b02c4ffa4db0ff123ea8497030f674a3707d4f1d 100644 (file)
--- a/drivers/ata/sata_dwc_460ex.c
+++ b/drivers/ata/sata_dwc_460ex.c
@@ -766,11 +766,15 @@ static int dma_dwc_xfer_setup(struct scatterlist *sg, int num_elems,
 static void dma_dwc_exit(struct sata_dwc_device *hsdev)
 {
        dev_dbg(host_pvt.dwc_dev, "%s:\n", __func__);
-       if (host_pvt.sata_dma_regs)
+       if (host_pvt.sata_dma_regs) {
                iounmap(host_pvt.sata_dma_regs);
+               host_pvt.sata_dma_regs = NULL;
+       }
 
-       if (hsdev->irq_dma)
+       if (hsdev->irq_dma) {
                free_irq(hsdev->irq_dma, hsdev);
+               hsdev->irq_dma = 0;
+       }
 }
 
 /*
@@ -1642,7 +1646,7 @@ static int sata_dwc_probe(struct platform_device *ofdev)
        if (hsdev == NULL) {
                dev_err(&ofdev->dev, "kmalloc failed for hsdev\n");
                err = -ENOMEM;
-               goto error_out;
+               goto error;
        }
        memset(hsdev, 0, sizeof(*hsdev));
 
@@ -1652,7 +1656,7 @@ static int sata_dwc_probe(struct platform_device *ofdev)
                dev_err(&ofdev->dev, "ioremap failed for SATA register"
                        " address\n");
                err = -ENODEV;
-               goto error_out;
+               goto error_kmalloc;
        }
        hsdev->reg_base = base;
        dev_dbg(&ofdev->dev, "ioremap done for SATA register address\n");
@@ -1665,7 +1669,7 @@ static int sata_dwc_probe(struct platform_device *ofdev)
        if (!host) {
                dev_err(&ofdev->dev, "ata_host_alloc_pinfo failed\n");
                err = -ENOMEM;
-               goto error_out;
+               goto error_iomap;
        }
 
        host->private_data = hsdev;
@@ -1733,8 +1737,11 @@ error_out:
        /* Free SATA DMA resources */
        dma_dwc_exit(hsdev);
 
-       if (base)
-               iounmap(base);
+error_iomap:
+       iounmap(base);
+error_kmalloc:
+       kfree(hsdev);
+error:
        return err;
 }