| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Wed, 30 Sep 2015 11:39:45 +0530
From: Ronit Halder <ronit.crj@...il.com>
To: lidza.louina@...il.com
Cc: daeseok.youn@...il.com, gregkh@...uxfoundation.org,
driverdev-devel@...uxdriverproject.org, devel@...verdev.osuosl.org,
linux-kernel@...r.kernel.org, Ronit Halder <ronit.crj@...il.com>
Subject: [PATCH] staging: dgap: fix memory leak in dgap_parsefile()
In dgap_parsefile() char pointers are set with kstrdup()
without checking that some string is allocated to that
char pointer before. This patch frees the memory if already allocated
and then set the poniter with kstrdup().
Signed-off-by: Ronit halder <ronit.crj@...il.com>
---
drivers/staging/dgap/dgap.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
diff --git a/drivers/staging/dgap/dgap.c b/drivers/staging/dgap/dgap.c
index e17bde7..64f6149 100644
--- a/drivers/staging/dgap/dgap.c
+++ b/drivers/staging/dgap/dgap.c
@@ -672,6 +672,7 @@ static int dgap_parsefile(char **in)
pr_err("unexpected end of file");
return -1;
}
+ kfree(p->u.board.portstr);
p->u.board.portstr = kstrdup(s, GFP_KERNEL);
if (kstrtol(s, 0, &p->u.board.port)) {
pr_err("bad number for IO port");
@@ -690,6 +691,7 @@ static int dgap_parsefile(char **in)
pr_err("unexpected end of file");
return -1;
}
+ kfree(p->u.board.addrstr);
p->u.board.addrstr = kstrdup(s, GFP_KERNEL);
if (kstrtoul(s, 0, &p->u.board.addr)) {
pr_err("bad number for memory address");
@@ -708,6 +710,7 @@ static int dgap_parsefile(char **in)
pr_err("unexpected end of file");
return -1;
}
+ kfree(p->u.board.pcibusstr);
p->u.board.pcibusstr = kstrdup(s, GFP_KERNEL);
if (kstrtoul(s, 0, &p->u.board.pcibus)) {
pr_err("bad number for pci bus");
@@ -719,6 +722,7 @@ static int dgap_parsefile(char **in)
pr_err("unexpected end of file");
return -1;
}
+ kfree(p->u.board.pcislotstr);
p->u.board.pcislotstr = kstrdup(s, GFP_KERNEL);
if (kstrtoul(s, 0, &p->u.board.pcislot)) {
pr_err("bad number for pci slot");
@@ -737,6 +741,7 @@ static int dgap_parsefile(char **in)
pr_err("unexpected end of file");
return -1;
}
+ kfree(p->u.board.method);
p->u.board.method = kstrdup(s, GFP_KERNEL);
p->u.board.v_method = 1;
break;
@@ -751,6 +756,7 @@ static int dgap_parsefile(char **in)
pr_err("unexpected end of file");
return -1;
}
+ kfree(p->u.board.status);
p->u.board.status = kstrdup(s, GFP_KERNEL);
break;
@@ -800,13 +806,15 @@ static int dgap_parsefile(char **in)
pr_err("unexpected end of file");
return -1;
}
-
+ kfree(p->u.board.status);
p->u.board.status = kstrdup(s, GFP_KERNEL);
if (p->type == CNODE) {
+ kfree(p->u.conc.id);
p->u.conc.id = kstrdup(s, GFP_KERNEL);
p->u.conc.v_id = 1;
} else if (p->type == MNODE) {
+ kfree(p->u.module.id);
p->u.module.id = kstrdup(s, GFP_KERNEL);
p->u.module.v_id = 1;
} else {
@@ -1003,6 +1011,7 @@ static int dgap_parsefile(char **in)
pr_err("unexpected end of file");
return -1;
}
+ kfree(p->u.line.cable);
p->u.line.cable = kstrdup(s, GFP_KERNEL);
p->u.line.v_cable = 1;
}
@@ -1044,6 +1053,7 @@ static int dgap_parsefile(char **in)
pr_err("unexpected end of file");
return -1;
}
+ kfree(p->u.conc.connect);
p->u.conc.connect = kstrdup(s, GFP_KERNEL);
p->u.conc.v_connect = 1;
}
--
2.4.0.GIT
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists