A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-31 04:01:48 -04:00
Code Issues Projects Releases Packages Wiki Activity

fs/efivarfs: Fix double kfree() in error path

Browse source 
Julia reported that we may double free 'name' in efivarfs_callback(),
and that this bug was introduced by commit 0d22f33bc37c ("efi: Don't
use spinlocks for efi vars").

Move one of the kfree()s until after the point at which we know we are
definitely on the success path.

Reported-by: Julia Lawall <[email protected]>
Acked-by: Julia Lawall <[email protected]>
Cc: Ard Biesheuvel <[email protected]>
Cc: Sylvain Chouleur <[email protected]>
Signed-off-by: Matt Fleming <[email protected]>
This commit is contained in:
Matt Fleming 2016-08-15 15:29:20 +01:00
commit 22c2b77f41
1 changed files with 3 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

6
fs/efivarfs/super.c
View file

@ -157,14 +157,14 @@ static int efivarfs_callback(efi_char16_t *name16, efi_guid_t vendor,
goto fail_inode;
}
/* copied by the above to local storage in the dentry. */
kfree(name);
efivar_entry_size(entry, &size);
err = efivar_entry_add(entry, &efivarfs_list);
if (err)
goto fail_inode;
/* copied by the above to local storage in the dentry. */
kfree(name);
inode_lock(inode);
inode->i_private = entry;
i_size_write(inode, size + sizeof(entry->var.Attributes));