* [PATCH] NFC: fdp: fix incorrect free object
@ 2019-11-05 8:34 Pan Bian
2019-11-06 2:32 ` David Miller
0 siblings, 1 reply; 2+ messages in thread
From: Pan Bian @ 2019-11-05 8:34 UTC (permalink / raw)
To: Allison Randal, Greg Kroah-Hartman, Thomas Gleixner,
Richard Fontana, Kate Stewart
Cc: netdev, linux-kernel, Pan Bian
The address of fw_vsc_cfg is on stack. Releasing it with devm_kfree() is
incorrect, which may result in a system crash or other security impacts.
The expected object to free is *fw_vsc_cfg.
Signed-off-by: Pan Bian <bianpan2016@163.com>
---
drivers/nfc/fdp/i2c.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/nfc/fdp/i2c.c b/drivers/nfc/fdp/i2c.c
index 1cd113c8d7cb..ad0abb1f0bae 100644
--- a/drivers/nfc/fdp/i2c.c
+++ b/drivers/nfc/fdp/i2c.c
@@ -259,7 +259,7 @@ static void fdp_nci_i2c_read_device_properties(struct device *dev,
*fw_vsc_cfg, len);
if (r) {
- devm_kfree(dev, fw_vsc_cfg);
+ devm_kfree(dev, *fw_vsc_cfg);
goto vsc_read_err;
}
} else {
--
2.7.4
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] NFC: fdp: fix incorrect free object
2019-11-05 8:34 [PATCH] NFC: fdp: fix incorrect free object Pan Bian
@ 2019-11-06 2:32 ` David Miller
0 siblings, 0 replies; 2+ messages in thread
From: David Miller @ 2019-11-06 2:32 UTC (permalink / raw)
To: bianpan2016
Cc: allison, gregkh, tglx, rfontana, kstewart, netdev, linux-kernel
From: Pan Bian <bianpan2016@163.com>
Date: Tue, 5 Nov 2019 16:34:07 +0800
> The address of fw_vsc_cfg is on stack. Releasing it with devm_kfree() is
> incorrect, which may result in a system crash or other security impacts.
> The expected object to free is *fw_vsc_cfg.
>
> Signed-off-by: Pan Bian <bianpan2016@163.com>
Applied and queued up for -stable, thanks.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2019-11-06 2:32 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-11-05 8:34 [PATCH] NFC: fdp: fix incorrect free object Pan Bian
2019-11-06 2:32 ` David Miller
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.