lkml.org 
[lkml]   [2020]   [Dec]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 107/242] memstick: fix a double-free bug in memstick_check
    Date
    From: Qinglang Miao <miaoqinglang@huawei.com>

    [ Upstream commit e3e9ced5c93803d5b2ea1942c4bf0192622531d6 ]

    kfree(host->card) has been called in put_device so that
    another kfree would raise cause a double-free bug.

    Fixes: 0193383a5833 ("memstick: core: fix device_register() error handling")
    Reported-by: Hulk Robot <hulkci@huawei.com>
    Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com>
    Link: https://lore.kernel.org/r/20201120074846.31322-1-miaoqinglang@huawei.com
    Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/memstick/core/memstick.c | 1 -
    1 file changed, 1 deletion(-)

    diff --git a/drivers/memstick/core/memstick.c b/drivers/memstick/core/memstick.c
    index b1564cacd19e1..20ae8652adf44 100644
    --- a/drivers/memstick/core/memstick.c
    +++ b/drivers/memstick/core/memstick.c
    @@ -469,7 +469,6 @@ static void memstick_check(struct work_struct *work)
    host->card = card;
    if (device_register(&card->dev)) {
    put_device(&card->dev);
    - kfree(host->card);
    host->card = NULL;
    }
    } else
    --
    2.27.0


    \
     
     \ /
      Last update: 2020-12-28 17:40    [W:3.580 / U:0.320 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site