* [patch] drivers: net: davinci_cpdma: double free on error
@ 2014-06-11 8:16 ` Dan Carpenter
0 siblings, 0 replies; 4+ messages in thread
From: Dan Carpenter @ 2014-06-11 8:16 UTC (permalink / raw)
To: David S. Miller
Cc: Olof Johansson, George Cherian, Christian Riesch, Daniel Mack,
Sebastian Siewior, netdev, kernel-janitors
We recently change the kzalloc() to devm_kzalloc() so freeing "ctlr"
here could lead to a double free.
Fixes: e194312854ed ('drivers: net: davinci_cpdma: Convert kzalloc() to devm_kzalloc().')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
diff --git a/drivers/net/ethernet/ti/davinci_cpdma.c b/drivers/net/ethernet/ti/davinci_cpdma.c
index 539dbde..4a000f6 100644
--- a/drivers/net/ethernet/ti/davinci_cpdma.c
+++ b/drivers/net/ethernet/ti/davinci_cpdma.c
@@ -285,10 +285,8 @@ struct cpdma_ctlr *cpdma_ctlr_create(struct cpdma_params *params)
ctlr->params.desc_hw_addr,
ctlr->params.desc_mem_size,
ctlr->params.desc_align);
- if (!ctlr->pool) {
- kfree(ctlr);
+ if (!ctlr->pool)
return NULL;
- }
if (WARN_ON(ctlr->num_chan > CPDMA_MAX_CHANNELS))
ctlr->num_chan = CPDMA_MAX_CHANNELS;
^ permalink raw reply related [flat|nested] 4+ messages in thread
* [patch] drivers: net: davinci_cpdma: double free on error
@ 2014-06-11 8:16 ` Dan Carpenter
0 siblings, 0 replies; 4+ messages in thread
From: Dan Carpenter @ 2014-06-11 8:16 UTC (permalink / raw)
To: David S. Miller
Cc: Olof Johansson, George Cherian, Christian Riesch, Daniel Mack,
Sebastian Siewior, netdev, kernel-janitors
We recently change the kzalloc() to devm_kzalloc() so freeing "ctlr"
here could lead to a double free.
Fixes: e194312854ed ('drivers: net: davinci_cpdma: Convert kzalloc() to devm_kzalloc().')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
diff --git a/drivers/net/ethernet/ti/davinci_cpdma.c b/drivers/net/ethernet/ti/davinci_cpdma.c
index 539dbde..4a000f6 100644
--- a/drivers/net/ethernet/ti/davinci_cpdma.c
+++ b/drivers/net/ethernet/ti/davinci_cpdma.c
@@ -285,10 +285,8 @@ struct cpdma_ctlr *cpdma_ctlr_create(struct cpdma_params *params)
ctlr->params.desc_hw_addr,
ctlr->params.desc_mem_size,
ctlr->params.desc_align);
- if (!ctlr->pool) {
- kfree(ctlr);
+ if (!ctlr->pool)
return NULL;
- }
if (WARN_ON(ctlr->num_chan > CPDMA_MAX_CHANNELS))
ctlr->num_chan = CPDMA_MAX_CHANNELS;
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [patch] drivers: net: davinci_cpdma: double free on error
2014-06-11 8:16 ` Dan Carpenter
@ 2014-06-11 22:40 ` David Miller
-1 siblings, 0 replies; 4+ messages in thread
From: David Miller @ 2014-06-11 22:40 UTC (permalink / raw)
To: dan.carpenter
Cc: olof, george.cherian, christian.riesch, zonque, bigeasy, netdev,
kernel-janitors
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Wed, 11 Jun 2014 11:16:51 +0300
> We recently change the kzalloc() to devm_kzalloc() so freeing "ctlr"
> here could lead to a double free.
>
> Fixes: e194312854ed ('drivers: net: davinci_cpdma: Convert kzalloc() to devm_kzalloc().')
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Applied.
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [patch] drivers: net: davinci_cpdma: double free on error
@ 2014-06-11 22:40 ` David Miller
0 siblings, 0 replies; 4+ messages in thread
From: David Miller @ 2014-06-11 22:40 UTC (permalink / raw)
To: dan.carpenter
Cc: olof, george.cherian, christian.riesch, zonque, bigeasy, netdev,
kernel-janitors
From: Dan Carpenter <dan.carpenter@oracle.com>
Date: Wed, 11 Jun 2014 11:16:51 +0300
> We recently change the kzalloc() to devm_kzalloc() so freeing "ctlr"
> here could lead to a double free.
>
> Fixes: e194312854ed ('drivers: net: davinci_cpdma: Convert kzalloc() to devm_kzalloc().')
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Applied.
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2014-06-11 22:40 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2014-06-11 8:16 [patch] drivers: net: davinci_cpdma: double free on error Dan Carpenter
2014-06-11 8:16 ` Dan Carpenter
2014-06-11 22:40 ` David Miller
2014-06-11 22:40 ` David Miller
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.