diff options
Diffstat (limited to 'extras/recipes-kernel/linux/linux-omap/linus/0039-ISDN-Gigaset-Fix-memory-leak-in-do_disconnect_req.patch')
-rw-r--r-- | extras/recipes-kernel/linux/linux-omap/linus/0039-ISDN-Gigaset-Fix-memory-leak-in-do_disconnect_req.patch | 56 |
1 files changed, 56 insertions, 0 deletions
diff --git a/extras/recipes-kernel/linux/linux-omap/linus/0039-ISDN-Gigaset-Fix-memory-leak-in-do_disconnect_req.patch b/extras/recipes-kernel/linux/linux-omap/linus/0039-ISDN-Gigaset-Fix-memory-leak-in-do_disconnect_req.patch new file mode 100644 index 00000000..24fdff6c --- /dev/null +++ b/extras/recipes-kernel/linux/linux-omap/linus/0039-ISDN-Gigaset-Fix-memory-leak-in-do_disconnect_req.patch | |||
@@ -0,0 +1,56 @@ | |||
1 | From 7b63a1b5eed2e8f4c90cef7ba893dd95ab1d71ae Mon Sep 17 00:00:00 2001 | ||
2 | From: Jesper Juhl <jj@chaosbits.net> | ||
3 | Date: Sun, 26 Dec 2010 09:59:58 +0000 | ||
4 | Subject: [PATCH 39/65] ISDN, Gigaset: Fix memory leak in do_disconnect_req() | ||
5 | |||
6 | Hi, | ||
7 | |||
8 | In drivers/isdn/gigaset/capi.c::do_disconnect_req() we will leak the | ||
9 | memory allocated (with kmalloc) to 'b3cmsg' if the call to alloc_skb() | ||
10 | fails. | ||
11 | |||
12 | ... | ||
13 | b3cmsg = kmalloc(sizeof(*b3cmsg), GFP_KERNEL); | ||
14 | allocation here ------^ | ||
15 | if (!b3cmsg) { | ||
16 | dev_err(cs->dev, "%s: out of memory\n", __func__); | ||
17 | send_conf(iif, ap, skb, CAPI_MSGOSRESOURCEERR); | ||
18 | return; | ||
19 | } | ||
20 | capi_cmsg_header(b3cmsg, ap->id, CAPI_DISCONNECT_B3, CAPI_IND, | ||
21 | ap->nextMessageNumber++, | ||
22 | cmsg->adr.adrPLCI | (1 << 16)); | ||
23 | b3cmsg->Reason_B3 = CapiProtocolErrorLayer1; | ||
24 | b3skb = alloc_skb(CAPI_DISCONNECT_B3_IND_BASELEN, GFP_KERNEL); | ||
25 | if (b3skb == NULL) { | ||
26 | dev_err(cs->dev, "%s: out of memory\n", __func__); | ||
27 | send_conf(iif, ap, skb, CAPI_MSGOSRESOURCEERR); | ||
28 | return; | ||
29 | leak here ------^ | ||
30 | ... | ||
31 | |||
32 | This leak is easily fixed by just kfree()'ing the memory allocated to | ||
33 | 'b3cmsg' right before we return. The following patch does that. | ||
34 | |||
35 | Signed-off-by: Jesper Juhl <jj@chaosbits.net> | ||
36 | Acked-by: Tilman Schmidt <tilman@imap.cc> | ||
37 | Signed-off-by: David S. Miller <davem@davemloft.net> | ||
38 | --- | ||
39 | drivers/isdn/gigaset/capi.c | 1 + | ||
40 | 1 files changed, 1 insertions(+), 0 deletions(-) | ||
41 | |||
42 | diff --git a/drivers/isdn/gigaset/capi.c b/drivers/isdn/gigaset/capi.c | ||
43 | index bcc174e..658e75f 100644 | ||
44 | --- a/drivers/isdn/gigaset/capi.c | ||
45 | +++ b/drivers/isdn/gigaset/capi.c | ||
46 | @@ -1900,6 +1900,7 @@ static void do_disconnect_req(struct gigaset_capi_ctr *iif, | ||
47 | if (b3skb == NULL) { | ||
48 | dev_err(cs->dev, "%s: out of memory\n", __func__); | ||
49 | send_conf(iif, ap, skb, CAPI_MSGOSRESOURCEERR); | ||
50 | + kfree(b3cmsg); | ||
51 | return; | ||
52 | } | ||
53 | capi_cmsg2message(b3cmsg, | ||
54 | -- | ||
55 | 1.6.6.1 | ||
56 | |||