aboutsummaryrefslogtreecommitdiff
path: root/net/switchdev/switchdev.c
diff options
context:
space:
mode:
authorDan Carpenter <[email protected]>2019-08-29 15:28:39 +0300
committerGreg Kroah-Hartman <[email protected]>2019-09-03 09:39:10 +0200
commit329101244f214952606359d254ae883b7109e1a5 (patch)
tree338dd3afc11bf09b6e1738a5443bec8b4e54aaac /net/switchdev/switchdev.c
parent20738057210365bbcd8a718c04ded6c93a262b95 (diff)
staging: greybus: light: fix a couple double frees
The problem is in gb_lights_request_handler(). If we get a request to change the config then we release the light with gb_lights_light_release() and re-allocated it. However, if the allocation fails part way through then we call gb_lights_light_release() again. This can lead to a couple different double frees where we haven't cleared out the original values: gb_lights_light_v4l2_unregister(light); ... kfree(light->channels); kfree(light->name); I also made a small change to how we set "light->channels_count = 0;". The original code handled this part fine and did not cause a use after free but it was sort of complicated to read. Fixes: 2870b52bae4c ("greybus: lights: add lights implementation") Signed-off-by: Dan Carpenter <[email protected]> Acked-by: Rui Miguel Silva <[email protected]> Link: https://lore.kernel.org/r/20190829122839.GA20116@mwanda Signed-off-by: Greg Kroah-Hartman <[email protected]>
Diffstat (limited to 'net/switchdev/switchdev.c')
0 files changed, 0 insertions, 0 deletions