* [patch] drivers: net: davinci_cpdma: double free on error
@ 2014-06-11 8:16 Dan Carpenter
2014-06-11 22:40 ` David Miller
0 siblings, 1 reply; 2+ messages in thread
From: Dan Carpenter @ 2014-06-11 8:16 UTC (permalink / raw)
To: David S. Miller
Cc: Olof Johansson, George Cherian, Christian Riesch, Daniel Mack,
Sebastian Siewior, netdev, kernel-janitors
We recently change the kzalloc() to devm_kzalloc() so freeing "ctlr"
here could lead to a double free.
Fixes: e194312854ed ('drivers: net: davinci_cpdma: Convert kzalloc() to devm_kzalloc().')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
diff --git a/drivers/net/ethernet/ti/davinci_cpdma.c b/drivers/net/ethernet/ti/davinci_cpdma.c
index 539dbde..4a000f6 100644
--- a/drivers/net/ethernet/ti/davinci_cpdma.c
+++ b/drivers/net/ethernet/ti/davinci_cpdma.c
@@ -285,10 +285,8 @@ struct cpdma_ctlr *cpdma_ctlr_create(struct cpdma_params *params)
ctlr->params.desc_hw_addr,
ctlr->params.desc_mem_size,
ctlr->params.desc_align);
- if (!ctlr->pool) {
- kfree(ctlr);
+ if (!ctlr->pool)
return NULL;
- }
if (WARN_ON(ctlr->num_chan > CPDMA_MAX_CHANNELS))
ctlr->num_chan = CPDMA_MAX_CHANNELS;
^ permalink raw reply related [flat|nested] 2+ messages in thread
end of thread, other threads:[~2014-06-11 22:40 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2014-06-11 8:16 [patch] drivers: net: davinci_cpdma: double free on error Dan Carpenter
2014-06-11 22:40 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).