提交 852fef69 编写于 作者: O Oliver Neukum 提交者: Linus Torvalds

fix for a memory leak in an error case introduced by fix for double free

The fix NULLed a pointer without freeing it.
Signed-off-by: NOliver Neukum <oneukum@suse.de>
Reported-by: NJuha Motorsportcom <juha_motorsportcom@luukku.com>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
上级 9ee08c2d
...@@ -651,15 +651,17 @@ static int ipaq_open(struct tty_struct *tty, ...@@ -651,15 +651,17 @@ static int ipaq_open(struct tty_struct *tty,
*/ */
kfree(port->bulk_in_buffer); kfree(port->bulk_in_buffer);
kfree(port->bulk_out_buffer);
/* make sure the generic serial code knows */
port->bulk_out_buffer = NULL;
port->bulk_in_buffer = kmalloc(URBDATA_SIZE, GFP_KERNEL); port->bulk_in_buffer = kmalloc(URBDATA_SIZE, GFP_KERNEL);
if (port->bulk_in_buffer == NULL) { if (port->bulk_in_buffer == NULL)
port->bulk_out_buffer = NULL; /* prevent double free */
goto enomem; goto enomem;
}
kfree(port->bulk_out_buffer);
port->bulk_out_buffer = kmalloc(URBDATA_SIZE, GFP_KERNEL); port->bulk_out_buffer = kmalloc(URBDATA_SIZE, GFP_KERNEL);
if (port->bulk_out_buffer == NULL) { if (port->bulk_out_buffer == NULL) {
/* the buffer is useless, free it */
kfree(port->bulk_in_buffer); kfree(port->bulk_in_buffer);
port->bulk_in_buffer = NULL; port->bulk_in_buffer = NULL;
goto enomem; goto enomem;
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册