瀏覽代碼

[PATCH] drivers/hwmon/*: kfree() correct pointers

The adm9240 driver, in adm9240_detect(), allocates a structure.  The
error path attempts to kfree() ->client field of it (second one),
resulting in an oops (or slab corruption) if the hardware is not present.

->client field in adm1026, adm1031, smsc47b397 and smsc47m1 is the first in
${HWMON}_data structure, but fix them too.

Signed-off-by: Jonathan Corbet <corbet@lwn.net
Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Alexey Dobriyan 19 年之前
父節點
當前提交
1f57ff89fe
共有 5 個文件被更改,包括 5 次插入5 次删除
  1. 1 1
      drivers/hwmon/adm1026.c
  2. 1 1
      drivers/hwmon/adm1031.c
  3. 1 1
      drivers/hwmon/adm9240.c
  4. 1 1
      drivers/hwmon/smsc47b397.c
  5. 1 1
      drivers/hwmon/smsc47m1.c

+ 1 - 1
drivers/hwmon/adm1026.c

@@ -1691,7 +1691,7 @@ int adm1026_detect(struct i2c_adapter *adapter, int address,
 
 
 	/* Error out and cleanup code */
 	/* Error out and cleanup code */
 exitfree:
 exitfree:
-	kfree(new_client);
+	kfree(data);
 exit:
 exit:
 	return err;
 	return err;
 }
 }

+ 1 - 1
drivers/hwmon/adm1031.c

@@ -834,7 +834,7 @@ static int adm1031_detect(struct i2c_adapter *adapter, int address, int kind)
 	return 0;
 	return 0;
 
 
 exit_free:
 exit_free:
-	kfree(new_client);
+	kfree(data);
 exit:
 exit:
 	return err;
 	return err;
 }
 }

+ 1 - 1
drivers/hwmon/adm9240.c

@@ -616,7 +616,7 @@ static int adm9240_detect(struct i2c_adapter *adapter, int address, int kind)
 
 
 	return 0;
 	return 0;
 exit_free:
 exit_free:
-	kfree(new_client);
+	kfree(data);
 exit:
 exit:
 	return err;
 	return err;
 }
 }

+ 1 - 1
drivers/hwmon/smsc47b397.c

@@ -298,7 +298,7 @@ static int smsc47b397_detect(struct i2c_adapter *adapter, int addr, int kind)
 	return 0;
 	return 0;
 
 
 error_free:
 error_free:
-	kfree(new_client);
+	kfree(data);
 error_release:
 error_release:
 	release_region(addr, SMSC_EXTENT);
 	release_region(addr, SMSC_EXTENT);
 	return err;
 	return err;

+ 1 - 1
drivers/hwmon/smsc47m1.c

@@ -495,7 +495,7 @@ static int smsc47m1_detect(struct i2c_adapter *adapter, int address, int kind)
 	return 0;
 	return 0;
 
 
 error_free:
 error_free:
-	kfree(new_client);
+	kfree(data);
 error_release:
 error_release:
 	release_region(address, SMSC_EXTENT);
 	release_region(address, SMSC_EXTENT);
 	return err;
 	return err;