From: Andrew Goodbody Date: Fri, 1 Aug 2025 09:54:04 +0000 (+0100) Subject: mtd: rawnand: cortina_nand: Fix -ENOMEM detection X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=ebf8aaf7afdeb306b0fb85be2226a00aef18162f;p=thirdparty%2Fu-boot.git mtd: rawnand: cortina_nand: Fix -ENOMEM detection In init_nand_dma there was code to detect failure to allocate memory but it had two problems. Firstly the 2nd clause when info->tx_desc was NULL attempted to free info->tx_desc when it should be freeing info->rx_desc. Secondly there was no detection of both allocations failing, arguably the more likely scenario. Refactor the code to simplify it and just fail as soon as either allocation fails. This issue was found by Smatch. Signed-off-by: Andrew Goodbody Reviewed-by: Michael Trimarchi --- diff --git a/drivers/mtd/nand/raw/cortina_nand.c b/drivers/mtd/nand/raw/cortina_nand.c index 06918a46e93..a27a6994f56 100644 --- a/drivers/mtd/nand/raw/cortina_nand.c +++ b/drivers/mtd/nand/raw/cortina_nand.c @@ -186,14 +186,13 @@ int init_nand_dma(struct nand_chip *nand) info->tx_desc = malloc_cache_aligned((sizeof(struct tx_descriptor_t) * CA_DMA_DESC_NUM)); - info->rx_desc = malloc_cache_aligned((sizeof(struct rx_descriptor_t) * - CA_DMA_DESC_NUM)); - - if (!info->rx_desc && info->tx_desc) { + if (!info->tx_desc) { printf("Fail to alloc DMA descript!\n"); - kfree(info->tx_desc); return -ENOMEM; - } else if (info->rx_desc && !info->tx_desc) { + } + info->rx_desc = malloc_cache_aligned((sizeof(struct rx_descriptor_t) * + CA_DMA_DESC_NUM)); + if (!info->rx_desc) { printf("Fail to alloc DMA descript!\n"); kfree(info->tx_desc); return -ENOMEM;