From e40520b5b585c82d90e94c54cb3035b277e8280f Mon Sep 17 00:00:00 2001
From: Masahiro Yamada <yamada.m@jp.panasonic.com>
Date: Thu, 11 Jul 2013 17:27:12 +0900
Subject: [PATCH] cmd_nand: fix a memory leak in nand_dump function

If datbuf = memalign(ARCH_DMA_MINALIGN, nand->writesize);
succeeds and
  oobbuf = memalign(ARCH_DMA_MINALIGN, nand->oobsize);
fails, nand_dump function should free databuf.

Signed-off-by: Masahiro Yamada <yamada.m@jp.panasonic.com>
---
 common/cmd_nand.c | 23 ++++++++++++++++-------
 1 file changed, 16 insertions(+), 7 deletions(-)

diff --git a/common/cmd_nand.c b/common/cmd_nand.c
index 886212a..a66f569 100644
--- a/common/cmd_nand.c
+++ b/common/cmd_nand.c
@@ -42,6 +42,7 @@ static int nand_dump(nand_info_t *nand, ulong off, int only_oob, int repeat)
 	int i;
 	u_char *datbuf, *oobbuf, *p;
 	static loff_t last;
+	int ret = 0;
 
 	if (repeat)
 		off = last + nand->writesize;
@@ -49,11 +50,17 @@ static int nand_dump(nand_info_t *nand, ulong off, int only_oob, int repeat)
 	last = off;
 
 	datbuf = memalign(ARCH_DMA_MINALIGN, nand->writesize);
-	oobbuf = memalign(ARCH_DMA_MINALIGN, nand->oobsize);
-	if (!datbuf || !oobbuf) {
+	if (!datbuf) {
 		puts("No memory for page buffer\n");
 		return 1;
 	}
+
+	oobbuf = memalign(ARCH_DMA_MINALIGN, nand->oobsize);
+	if (!oobbuf) {
+		puts("No memory for page buffer\n");
+		ret = 1;
+		goto free_dat;
+	}
 	off &= ~(nand->writesize - 1);
 	loff_t addr = (loff_t) off;
 	struct mtd_oob_ops ops;
@@ -66,9 +73,8 @@ static int nand_dump(nand_info_t *nand, ulong off, int only_oob, int repeat)
 	i = mtd_read_oob(nand, addr, &ops);
 	if (i < 0) {
 		printf("Error (%d) reading page %08lx\n", i, off);
-		free(datbuf);
-		free(oobbuf);
-		return 1;
+		ret = 1;
+		goto free_all;
 	}
 	printf("Page %08lx dump:\n", off);
 	i = nand->writesize >> 4;
@@ -91,10 +97,13 @@ static int nand_dump(nand_info_t *nand, ulong off, int only_oob, int repeat)
 		       p[0], p[1], p[2], p[3], p[4], p[5], p[6], p[7]);
 		p += 8;
 	}
-	free(datbuf);
+
+free_all:
 	free(oobbuf);
+free_dat:
+	free(datbuf);
 
-	return 0;
+	return ret;
 }
 
 /* ------------------------------------------------------------------------- */