[PATCH] drivers/hwmon/*: kfree() correct pointers
The adm9240 driver, in adm9240_detect(), allocates a structure. The error path attempts to kfree() ->client field of it (second one), resulting in an oops (or slab corruption) if the hardware is not present. ->client field in adm1026, adm1031, smsc47b397 and smsc47m1 is the first in ${HWMON}_data structure, but fix them too. Signed-off-by: Jonathan Corbet <corbet@lwn.net Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
This commit is contained in:
committed by
Linus Torvalds
parent
d634cc15e8
commit
1f57ff89fe
@@ -1691,7 +1691,7 @@ int adm1026_detect(struct i2c_adapter *adapter, int address,
|
|||||||
|
|
||||||
/* Error out and cleanup code */
|
/* Error out and cleanup code */
|
||||||
exitfree:
|
exitfree:
|
||||||
kfree(new_client);
|
kfree(data);
|
||||||
exit:
|
exit:
|
||||||
return err;
|
return err;
|
||||||
}
|
}
|
||||||
|
@@ -834,7 +834,7 @@ static int adm1031_detect(struct i2c_adapter *adapter, int address, int kind)
|
|||||||
return 0;
|
return 0;
|
||||||
|
|
||||||
exit_free:
|
exit_free:
|
||||||
kfree(new_client);
|
kfree(data);
|
||||||
exit:
|
exit:
|
||||||
return err;
|
return err;
|
||||||
}
|
}
|
||||||
|
@@ -616,7 +616,7 @@ static int adm9240_detect(struct i2c_adapter *adapter, int address, int kind)
|
|||||||
|
|
||||||
return 0;
|
return 0;
|
||||||
exit_free:
|
exit_free:
|
||||||
kfree(new_client);
|
kfree(data);
|
||||||
exit:
|
exit:
|
||||||
return err;
|
return err;
|
||||||
}
|
}
|
||||||
|
@@ -298,7 +298,7 @@ static int smsc47b397_detect(struct i2c_adapter *adapter, int addr, int kind)
|
|||||||
return 0;
|
return 0;
|
||||||
|
|
||||||
error_free:
|
error_free:
|
||||||
kfree(new_client);
|
kfree(data);
|
||||||
error_release:
|
error_release:
|
||||||
release_region(addr, SMSC_EXTENT);
|
release_region(addr, SMSC_EXTENT);
|
||||||
return err;
|
return err;
|
||||||
|
@@ -495,7 +495,7 @@ static int smsc47m1_detect(struct i2c_adapter *adapter, int address, int kind)
|
|||||||
return 0;
|
return 0;
|
||||||
|
|
||||||
error_free:
|
error_free:
|
||||||
kfree(new_client);
|
kfree(data);
|
||||||
error_release:
|
error_release:
|
||||||
release_region(address, SMSC_EXTENT);
|
release_region(address, SMSC_EXTENT);
|
||||||
return err;
|
return err;
|
||||||
|
Reference in New Issue
Block a user