[PATCH] nvdimm-btt: fix a potential memleak in btt_freelist_init

[Dinghao Liu]

When an error happens in btt_freelist_init(), its caller
discover_arenas() will directly free arena, which makes
arena->freelist allocated in btt_freelist_init() a leaked
memory. Fix this by freeing arena->freelist in all error
handling paths of btt_freelist_init().

Fixes: 5212e11fde4d ("nd_btt: atomic sector updates")
Signed-off-by: Dinghao Liu <dinghao....@zju.edu.cn>
---
 drivers/nvdimm/btt.c | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/drivers/nvdimm/btt.c b/drivers/nvdimm/btt.c
index d5593b0dc700..d8c4ba8bfdda 100644
--- a/drivers/nvdimm/btt.c
+++ b/drivers/nvdimm/btt.c
@@ -544,8 +544,10 @@ static int btt_freelist_init(struct arena_info *arena)
 
        for (i = 0; i < arena->nfree; i++) {
                new = btt_log_read(arena, i, &log_new, LOG_NEW_ENT);
-               if (new < 0)
-                       return new;
+               if (new < 0) {
+                       ret = new;
+                       goto out_free;
+               }
 
                /* old and new map entries with any flags stripped out */
                log_oldmap = ent_lba(le32_to_cpu(log_new.old_map));
@@ -577,7 +579,7 @@ static int btt_freelist_init(struct arena_info *arena)
                ret = btt_map_read(arena, le32_to_cpu(log_new.lba), &map_entry,
                                NULL, NULL, 0);
                if (ret)
-                       return ret;
+                       goto out_free;
 
                /*
                 * The map_entry from btt_read_map is stripped of any flag bits,
@@ -594,11 +596,16 @@ static int btt_freelist_init(struct arena_info *arena)
                        ret = btt_map_write(arena, le32_to_cpu(log_new.lba),
                                        le32_to_cpu(log_new.new_map), 0, 0, 0);
                        if (ret)
-                               return ret;
+                               goto out_free;
                }
        }
 
        return 0;
+
+out_free:
+       kfree(arena->freelist);
+       arena->freelist = NULL;
+       return ret;
 }
 
 static bool ent_is_padding(struct log_entry *ent)
-- 
2.17.1