regmap: ram: fix memory leaks in __regmap_init_ram() on error

Two allocations in __regmap_init_ram() are not cleaned up on failure.

If the kzalloc_objs() for data->written fails, data->read is returned
with no way for the caller to free it.

If __regmap_init() fails, neither data->read nor data->written is freed
because its error paths do not call bus->free_context() (which is
regmap_ram_free_context() here). Only regmap_exit() does, and that is
never reached on an init failure.

Free the allocated arrays before returning any error.

Fixes: f6352424e37e ("regmap: Add RAM backed register map")
Signed-off-by: Yuho Choi <dbgh9129@gmail.com>
Link: https://patch.msgid.link/20260416235630.78408-1-dbgh9129@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>

diff --git a/drivers/base/regmap/regmap-ram.c b/drivers/base/regmap/regmap-ram.c
index 0272d53fead11969c82f521592d8f171d4eb831f..c7356b0d8c8327a9de3c9ca2dc2b1656abd5d645 100644 (file)
--- a/drivers/base/regmap/regmap-ram.c
+++ b/drivers/base/regmap/regmap-ram.c
@@ -71,11 +71,17 @@ struct regmap *__regmap_init_ram(struct device *dev,
                return ERR_PTR(-ENOMEM);
 
        data->written = kzalloc_objs(bool, config->max_register + 1);
-       if (!data->written)
+       if (!data->written) {
+               kfree(data->read);
                return ERR_PTR(-ENOMEM);
+       }
 
        map = __regmap_init(dev, &regmap_ram, data, config,
                            lock_key, lock_name);
+       if (IS_ERR(map)) {
+               kfree(data->read);
+               kfree(data->written);
+       }
 
        return map;
 }