提交 1f57ff89 编写于 作者: A Alexey Dobriyan 提交者: Linus Torvalds

[PATCH] drivers/hwmon/*: kfree() correct pointers

The adm9240 driver, in adm9240_detect(), allocates a structure.  The
error path attempts to kfree() ->client field of it (second one),
resulting in an oops (or slab corruption) if the hardware is not present.

->client field in adm1026, adm1031, smsc47b397 and smsc47m1 is the first in
${HWMON}_data structure, but fix them too.

Signed-off-by: Jonathan Corbet <corbet@lwn.net
Signed-off-by: NAlexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: NLinus Torvalds <torvalds@osdl.org>
上级 d634cc15
...@@ -1691,7 +1691,7 @@ int adm1026_detect(struct i2c_adapter *adapter, int address, ...@@ -1691,7 +1691,7 @@ int adm1026_detect(struct i2c_adapter *adapter, int address,
/* Error out and cleanup code */ /* Error out and cleanup code */
exitfree: exitfree:
kfree(new_client); kfree(data);
exit: exit:
return err; return err;
} }
......
...@@ -834,7 +834,7 @@ static int adm1031_detect(struct i2c_adapter *adapter, int address, int kind) ...@@ -834,7 +834,7 @@ static int adm1031_detect(struct i2c_adapter *adapter, int address, int kind)
return 0; return 0;
exit_free: exit_free:
kfree(new_client); kfree(data);
exit: exit:
return err; return err;
} }
......
...@@ -616,7 +616,7 @@ static int adm9240_detect(struct i2c_adapter *adapter, int address, int kind) ...@@ -616,7 +616,7 @@ static int adm9240_detect(struct i2c_adapter *adapter, int address, int kind)
return 0; return 0;
exit_free: exit_free:
kfree(new_client); kfree(data);
exit: exit:
return err; return err;
} }
......
...@@ -298,7 +298,7 @@ static int smsc47b397_detect(struct i2c_adapter *adapter, int addr, int kind) ...@@ -298,7 +298,7 @@ static int smsc47b397_detect(struct i2c_adapter *adapter, int addr, int kind)
return 0; return 0;
error_free: error_free:
kfree(new_client); kfree(data);
error_release: error_release:
release_region(addr, SMSC_EXTENT); release_region(addr, SMSC_EXTENT);
return err; return err;
......
...@@ -495,7 +495,7 @@ static int smsc47m1_detect(struct i2c_adapter *adapter, int address, int kind) ...@@ -495,7 +495,7 @@ static int smsc47m1_detect(struct i2c_adapter *adapter, int address, int kind)
return 0; return 0;
error_free: error_free:
kfree(new_client); kfree(data);
error_release: error_release:
release_region(address, SMSC_EXTENT); release_region(address, SMSC_EXTENT);
return err; return err;
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册