Messages in this thread Patch in this message | | | Date | Wed, 16 Apr 2008 18:01:25 -0700 | From | Chris Wright <> | Subject | mtd: memory corruption in block2mtd.c |
| |
-stable review patch. If anyone has any objections, please let us know. ---------------------
From: Ingo van Lil <inguin@gmx.de>
upstream commit: 2875fb65f8e40401c4b781ebc5002df10485f635
The block2mtd driver (drivers/mtd/devices/block2mtd.c) will kfree an on-stack pointer when handling an invalid argument line (e.g. block2mtd=/dev/loop0,xxx).
The kfree was added some time ago when "name" was dynamically allocated.
Signed-off-by: Ingo van Lil <inguin@gmx.de> Acked-by: Joern Engel <joern@lazybastard.org> Cc: David Woodhouse <dwmw2@infradead.org> Cc: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Chris Wright <chrisw@sous-sol.org> --- drivers/mtd/devices/block2mtd.c | 1 - 1 file changed, 1 deletion(-)
--- a/drivers/mtd/devices/block2mtd.c +++ b/drivers/mtd/devices/block2mtd.c @@ -408,7 +408,6 @@ static int block2mtd_setup2(const char * if (token[1]) { ret = parse_num(&erase_size, token[1]); if (ret) { - kfree(name); parse_err("illegal erase size"); } } --
| |