* [PATCH] drivers/mtd/mtdchar.c
@ 2001-05-21 23:38 Philip Wang
2001-05-22 0:15 ` David Woodhouse
0 siblings, 1 reply; 2+ messages in thread
From: Philip Wang @ 2001-05-21 23:38 UTC (permalink / raw)
To: alan; +Cc: torvalds, linux-kernel, Dawson Engler
Hello!
I'm Philip, from Professor Dawson Engler's Meta-Compilation Group at
Stanford University.
There is a bug in mtdchar.c of not freeing memory on error paths. databuf
is allocated but not freed if copy_from_user fails. The addition I made
was to kfree databuf before returning -EFAULT. Thanks!
Warmly,
Philip
linux/2.4.4/drivers/mtd/mtdchar.c Fri Feb 9 11:30:23 2001
+++ mtdchar.c Mon May 21 13:33:02 2001
@@ -310,9 +310,10 @@
if (!databuf)
return -ENOMEM;
- if (copy_from_user(databuf, buf.ptr, buf.length))
- return -EFAULT;
-
+ if (copy_from_user(databuf, buf.ptr, buf.length)) {
+ kfree(databuf);
+ return -EFAULT;
+ }
ret = (mtd->write_oob)(mtd, buf.start, buf.length, &retlen,
databuf);
if (copy_to_user((void *)arg + sizeof(loff_t), &retlen,
sizeof(ssize_t)))
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [PATCH] drivers/mtd/mtdchar.c
2001-05-21 23:38 [PATCH] drivers/mtd/mtdchar.c Philip Wang
@ 2001-05-22 0:15 ` David Woodhouse
0 siblings, 0 replies; 2+ messages in thread
From: David Woodhouse @ 2001-05-22 0:15 UTC (permalink / raw)
To: Philip Wang; +Cc: alan, torvalds, linux-kernel, Dawson Engler
PXWang@stanford.edu said:
> There is a bug in mtdchar.c of not freeing memory on error paths.
> databuf is allocated but not freed if copy_from_user fails. The
> addition I made was to kfree databuf before returning -EFAULT.
> Thanks!
Thankyou. I've now committed the fix to my tree and it'll be in the next
merge with Linus, which should hopefully happen quite soon.
--
dwmw2
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2001-05-22 0:16 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2001-05-21 23:38 [PATCH] drivers/mtd/mtdchar.c Philip Wang
2001-05-22 0:15 ` David Woodhouse
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox