From nobody Sat Jun 27 16:09:46 2026 Received: from mail-pf1-f171.google.com (mail-pf1-f171.google.com [209.85.210.171]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 30211386C3E for ; Mon, 8 Jun 2026 16:29:45 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.171 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780936186; cv=none; b=tTSteCzWepsGObBA0w85MRO5DOrVsiKYf69oSVQvgcxg0fx/VYB/mbtJvIGqnKYepAHWkXDdiCEMOBdkSLJw5HMok1HAnC/lioiU7melW0GGiBJoXn+p9bBy9F6KYfSNcVRsvAQaAFx/AwSgVJ/IiZcMO8XgoxdRUdyFErRlVq0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780936186; c=relaxed/simple; bh=0x7iMagetsDCf5MbPGxvOiy/MdaUuiGBXKHf85QIMgg=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=AnpEBC7sATh2h1mi4BovhYCVnaSD9Y1+qXYypd3N2qE7oYMapylmTcIYK4fGNEMQTocfdO1Gfp5Cz38JsZJYStACXSmhhGL63B0n/PY/3eIt1qcwU0F2iCxMfGdZmwTnKuBHCg2BaclpEBT7Hvbs7sDzSK7F443R9jIKqa1TstI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=Iue8F0vU; arc=none smtp.client-ip=209.85.210.171 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Iue8F0vU" Received: by mail-pf1-f171.google.com with SMTP id d2e1a72fcca58-842338c18e0so3184279b3a.1 for ; Mon, 08 Jun 2026 09:29:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1780936184; x=1781540984; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=b+8emAbA9Qe2QPTAVFSijG7IdGtj1XKMqOrP2cN75Qs=; b=Iue8F0vUuXpDnQjPToRb6LwOw8vlErInSQWCZPQHAcuIcpJpbYmcfnDBDteNjbasJB /l0/Ywi8RbHd323AB2uoRjA4Jjvv/ds9SUxl0lyQehtZPKZifeNhPKUfUi4aa60OlZJJ q6X6L+nNrTXio9mW9glA1PQiHEseKHFUCb7XeuN0QjbWzyaXUukKl7QEnYfz+Zx5CDw+ Kn5kxvfkJnqR/9vq/7p6fIpNq//5Ow6QkzMSrE3p1V1AHw+vpWTkY7MmTw+D7KixscZP 83RAghaFFdMpFeOcOmFGbPfQlwP7rdEXBOi5pqQ3wFS/orWGJiVbsECEjl41hyXXKKad UuIA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780936184; x=1781540984; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=b+8emAbA9Qe2QPTAVFSijG7IdGtj1XKMqOrP2cN75Qs=; b=OoATZCC76ch5KEWiE8vEiTDMP0wsrDPG29qtMQ8/7CNsXbpfftc/ku8BHeKhbZnM5W fSJo2me6KsjRlhCnKgasQBhSjw3+0WS6o+5baozM/M6jw7kdaZMN1a7M4hhR3O7ZY55s Ca4gS57OTw9TpXxvgLaXyFmeOQSJBIptvabvBaQrqh0UrOQvmJ3pCSp+BG9zEqXx1SJ1 BuXkeK2q2fsWeCyHeD1arVsG8c3MtRtdLdSSkzqo1RzRNIkYuIaZslzL5xtL9gs08zmZ QJQ7OvysXWiN9EsKNLIrr2I8Rl7XJ+DlaCwHh6ftZDj//2MoWlNbHldfkg0I+BQMM3Tl vViw== X-Forwarded-Encrypted: i=1; AFNElJ+zim/3iZCM/5Vm77Ie3VqvyqrwL5Aceq//wYiJP6hVZ9qGdmIkrDYvb2tHMCc2O+pbqAooROAgIo3hDUg=@vger.kernel.org X-Gm-Message-State: AOJu0YyaQw7ME2zc2hBH4UhLlAS+mDpo2xQZX0ewqk3ijrgJL73GSNfs WxdyaUugY5tGknyK6A4ZQxqKso39UqwaLvq8EOEeIoe04BPWFR27U/8Q X-Gm-Gg: Acq92OHTAAZKqjFFTCJ6Xhw0fQGsPWsvlq31Pro1TftbRZVaAGsbKYOJHmFgymq2mwd EU4IbnAaDTxPMISc+gri5UaEF6YX48eVR8YKqUiAS6H9edTMIfKLAS2XrPSUULDn2eD0jzwsI3d P72evpV+6EDSwVDOfePmTKt2XBXyO0kejd6EGv1JwyOWfPkLQ3i3AiORmhTd0jsQIBMPglmXFDh dy4NE/bwzHvS49Ipy/1lJyEUtnSLyYN/jVhQ8zUunFqLOoxjeXMZamj/o+LQRPArZ2W9UTjfSS+ f7D75SDmJNQhNphMruJ3WCXojXx05819rcWzu9yYkjmVDhj+7Rhve6l3jZv1nEyLjiMq5tRAvjM rNwP6lzAfUcrdm+ALNliaX+AQRXCWgUhFSG2Ls51IGw6tN3s1lSvspFMo9lDIuY+/1xgPDfB1zC mgI5cykXK0DeAEjRXJuKtW8m7MQxvhLGPqkftOO5ddxG2yRLNvGrjY X-Received: by 2002:a05:6a00:909d:b0:842:7e71:b74 with SMTP id d2e1a72fcca58-842b0feef31mr16255771b3a.44.1780936184472; Mon, 08 Jun 2026 09:29:44 -0700 (PDT) Received: from haichao.tail057a43.ts.net ([2001:da8:e000:1206:9a2:954d:67fe:d9c2]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-84282375f2dsm19851022b3a.19.2026.06.08.09.29.42 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 08 Jun 2026 09:29:44 -0700 (PDT) From: Ruoyu Wang To: Miquel Raynal , Richard Weinberger , Vignesh Raghavendra Cc: linux-mtd@lists.infradead.org, linux-kernel@vger.kernel.org Subject: [PATCH] mtd: slram: avoid dangling device list entries Date: Tue, 9 Jun 2026 00:29:39 +0800 Message-ID: <20260608162939.6-1-ruoyuw560@gmail.com> X-Mailer: git-send-email 2.51.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" register_device() links a new slram_mtdlist entry before the entry is fully initialized. If a later allocation, memremap(), or mtd_device_register() fails, the failed entry can remain reachable from the global list and later cleanup can dereference or free invalid state. Build the new entry off-list, unwind partial initialization locally on failure, and only publish the entry after mtd_device_register() succeeds. Signed-off-by: Ruoyu Wang --- drivers/mtd/devices/slram.c | 95 ++++++++++++++++++++----------------- 1 file changed, 51 insertions(+), 44 deletions(-) diff --git a/drivers/mtd/devices/slram.c b/drivers/mtd/devices/slram.c index 69cb63d99f573..c7f6beba078fe 100644 --- a/drivers/mtd/devices/slram.c +++ b/drivers/mtd/devices/slram.c @@ -129,71 +129,78 @@ static int slram_write(struct mtd_info *mtd, loff_t t= o, size_t len, static int register_device(char *name, unsigned long start, unsigned long = length) { slram_mtd_list_t **curmtd; + slram_mtd_list_t *new_mtd; + struct mtd_info *mtdinfo =3D NULL; + slram_priv_t *priv =3D NULL; + int ret =3D -ENOMEM; =20 curmtd =3D &slram_mtdlist; while (*curmtd) { curmtd =3D &(*curmtd)->next; } =20 - *curmtd =3D kmalloc_obj(slram_mtd_list_t); - if (!(*curmtd)) { + new_mtd =3D kmalloc_obj(slram_mtd_list_t); + if (!new_mtd) { E("slram: Cannot allocate new MTD device.\n"); - return(-ENOMEM); + return -ENOMEM; } - (*curmtd)->mtdinfo =3D kzalloc_obj(struct mtd_info); - (*curmtd)->next =3D NULL; + new_mtd->next =3D NULL; =20 - if ((*curmtd)->mtdinfo) { - (*curmtd)->mtdinfo->priv =3D - kzalloc_obj(slram_priv_t); - - if (!(*curmtd)->mtdinfo->priv) { - kfree((*curmtd)->mtdinfo); - (*curmtd)->mtdinfo =3D NULL; - } + mtdinfo =3D kzalloc_obj(struct mtd_info); + if (!mtdinfo) { + E("slram: Cannot allocate new MTD device.\n"); + goto out_free; } + new_mtd->mtdinfo =3D mtdinfo; =20 - if (!(*curmtd)->mtdinfo) { + priv =3D kzalloc_obj(slram_priv_t); + if (!priv) { E("slram: Cannot allocate new MTD device.\n"); - return(-ENOMEM); + goto out_free; } + mtdinfo->priv =3D priv; =20 - if (!(((slram_priv_t *)(*curmtd)->mtdinfo->priv)->start =3D - memremap(start, length, - MEMREMAP_WB | MEMREMAP_WT | MEMREMAP_WC))) { + priv->start =3D memremap(start, length, + MEMREMAP_WB | MEMREMAP_WT | MEMREMAP_WC); + if (!priv->start) { E("slram: memremap failed\n"); - return -EIO; + ret =3D -EIO; + goto out_free; } - ((slram_priv_t *)(*curmtd)->mtdinfo->priv)->end =3D - ((slram_priv_t *)(*curmtd)->mtdinfo->priv)->start + length; - - - (*curmtd)->mtdinfo->name =3D name; - (*curmtd)->mtdinfo->size =3D length; - (*curmtd)->mtdinfo->flags =3D MTD_CAP_RAM; - (*curmtd)->mtdinfo->_erase =3D slram_erase; - (*curmtd)->mtdinfo->_point =3D slram_point; - (*curmtd)->mtdinfo->_unpoint =3D slram_unpoint; - (*curmtd)->mtdinfo->_read =3D slram_read; - (*curmtd)->mtdinfo->_write =3D slram_write; - (*curmtd)->mtdinfo->owner =3D THIS_MODULE; - (*curmtd)->mtdinfo->type =3D MTD_RAM; - (*curmtd)->mtdinfo->erasesize =3D SLRAM_BLK_SZ; - (*curmtd)->mtdinfo->writesize =3D 1; - - if (mtd_device_register((*curmtd)->mtdinfo, NULL, 0)) { + priv->end =3D priv->start + length; + + mtdinfo->name =3D name; + mtdinfo->size =3D length; + mtdinfo->flags =3D MTD_CAP_RAM; + mtdinfo->_erase =3D slram_erase; + mtdinfo->_point =3D slram_point; + mtdinfo->_unpoint =3D slram_unpoint; + mtdinfo->_read =3D slram_read; + mtdinfo->_write =3D slram_write; + mtdinfo->owner =3D THIS_MODULE; + mtdinfo->type =3D MTD_RAM; + mtdinfo->erasesize =3D SLRAM_BLK_SZ; + mtdinfo->writesize =3D 1; + + ret =3D mtd_device_register(mtdinfo, NULL, 0); + if (ret) { E("slram: Failed to register new device\n"); - memunmap(((slram_priv_t *)(*curmtd)->mtdinfo->priv)->start); - kfree((*curmtd)->mtdinfo->priv); - kfree((*curmtd)->mtdinfo); - return(-EAGAIN); + goto out_unmap; } + *curmtd =3D new_mtd; T("slram: Registered device %s from %luKiB to %luKiB\n", name, (start / 1024), ((start + length) / 1024)); T("slram: Mapped from 0x%p to 0x%p\n", - ((slram_priv_t *)(*curmtd)->mtdinfo->priv)->start, - ((slram_priv_t *)(*curmtd)->mtdinfo->priv)->end); - return(0); + priv->start, priv->end); + return 0; + +out_unmap: + memunmap(priv->start); +out_free: + kfree(priv); + kfree(mtdinfo); + kfree(new_mtd); + return ret; } =20 static void unregister_devices(void) --=20 2.51.0