提交 92788ac1 编写于 作者: A Andrew Morton 提交者: Linus Torvalds

drivers/input/evdev.c: don't kfree() a vmalloc address

If kzalloc() failed and then evdev_open_device() fails, evdev_open()
will pass a vmalloc'ed pointer to kfree.

This might fix https://bugzilla.kernel.org/show_bug.cgi?id=88401, where
there was a crash in kfree().
Reported-by: NChristian Casteyde <casteyde.christian@free.fr>
Belatedly-Acked-by: NDmitry Torokhov <dmitry.torokhov@gmail.com>
Cc: Henrik Rydberg <rydberg@euromail.se>
Cc: <stable@vger.kernel.org>
Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
上级 91b57191
...@@ -421,7 +421,7 @@ static int evdev_open(struct inode *inode, struct file *file) ...@@ -421,7 +421,7 @@ static int evdev_open(struct inode *inode, struct file *file)
err_free_client: err_free_client:
evdev_detach_client(evdev, client); evdev_detach_client(evdev, client);
kfree(client); kvfree(client);
return error; return error;
} }
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册