From: Dan Carpenter <dan.carpenter@oracle.com>
To: Evgeniy Polyakov <zbr@ioremap.net>,
Akira Shimahara <akira215corp@gmail.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Richard Fontana <rfontana@redhat.com>,
Allison Randal <allison@lohutok.net>,
linux-kernel@vger.kernel.org, kernel-janitors@vger.kernel.org
Subject: [PATCH] w1_therm: Free the correct variable
Date: Wed, 20 May 2020 12:00:19 +0000 [thread overview]
Message-ID: <20200520120019.GA172354@mwanda> (raw)
The problem is that we change "p_args" to point to the middle of the
string so when we free it at the end of the function it's not freeing
the same pointer that we originally allocated.
Fixes: e2c94d6f5720 ("w1_therm: adding alarm sysfs entry")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
From static analysis. I guess it must not cause too much of a problem
at run time?
drivers/w1/slaves/w1_therm.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/w1/slaves/w1_therm.c b/drivers/w1/slaves/w1_therm.c
index cc4b88056b33..a6c85e486671 100644
--- a/drivers/w1/slaves/w1_therm.c
+++ b/drivers/w1/slaves/w1_therm.c
@@ -1526,8 +1526,9 @@ static ssize_t alarms_store(struct device *device,
int temp, ret = -EINVAL;
char *token = NULL;
s8 tl, th, tt; /* 1 byte per value + temp ring order */
- char *p_args = kmalloc(size, GFP_KERNEL);
+ char *p_args, *orig;
+ p_args = orig = kmalloc(size, GFP_KERNEL);
/* Safe string copys as buf is const */
if (!p_args) {
dev_warn(device,
@@ -1611,7 +1612,7 @@ static ssize_t alarms_store(struct device *device,
free_m:
/* free allocated memory */
- kfree(p_args);
+ kfree(orig);
return size;
}
--
2.26.2
WARNING: multiple messages have this Message-ID (diff)
From: Dan Carpenter <dan.carpenter@oracle.com>
To: Evgeniy Polyakov <zbr@ioremap.net>,
Akira Shimahara <akira215corp@gmail.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
Richard Fontana <rfontana@redhat.com>,
Allison Randal <allison@lohutok.net>,
linux-kernel@vger.kernel.org, kernel-janitors@vger.kernel.org
Subject: [PATCH] w1_therm: Free the correct variable
Date: Wed, 20 May 2020 15:00:19 +0300 [thread overview]
Message-ID: <20200520120019.GA172354@mwanda> (raw)
The problem is that we change "p_args" to point to the middle of the
string so when we free it at the end of the function it's not freeing
the same pointer that we originally allocated.
Fixes: e2c94d6f5720 ("w1_therm: adding alarm sysfs entry")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
From static analysis. I guess it must not cause too much of a problem
at run time?
drivers/w1/slaves/w1_therm.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/w1/slaves/w1_therm.c b/drivers/w1/slaves/w1_therm.c
index cc4b88056b33..a6c85e486671 100644
--- a/drivers/w1/slaves/w1_therm.c
+++ b/drivers/w1/slaves/w1_therm.c
@@ -1526,8 +1526,9 @@ static ssize_t alarms_store(struct device *device,
int temp, ret = -EINVAL;
char *token = NULL;
s8 tl, th, tt; /* 1 byte per value + temp ring order */
- char *p_args = kmalloc(size, GFP_KERNEL);
+ char *p_args, *orig;
+ p_args = orig = kmalloc(size, GFP_KERNEL);
/* Safe string copys as buf is const */
if (!p_args) {
dev_warn(device,
@@ -1611,7 +1612,7 @@ static ssize_t alarms_store(struct device *device,
free_m:
/* free allocated memory */
- kfree(p_args);
+ kfree(orig);
return size;
}
--
2.26.2
next reply other threads:[~2020-05-20 12:00 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-05-20 12:00 Dan Carpenter [this message]
2020-05-20 12:00 ` [PATCH] w1_therm: Free the correct variable Dan Carpenter
2020-05-20 16:44 ` Akira shimahara
2020-05-20 16:44 ` Akira shimahara
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200520120019.GA172354@mwanda \
--to=dan.carpenter@oracle.com \
--cc=akira215corp@gmail.com \
--cc=allison@lohutok.net \
--cc=gregkh@linuxfoundation.org \
--cc=kernel-janitors@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=rfontana@redhat.com \
--cc=zbr@ioremap.net \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.