Commit 1f57ff89 authored by Alexey Dobriyan's avatar Alexey Dobriyan Committed by Linus Torvalds
Browse files

[PATCH] drivers/hwmon/*: kfree() correct pointers 



The adm9240 driver, in adm9240_detect(), allocates a structure.  The
error path attempts to kfree() ->client field of it (second one),
resulting in an oops (or slab corruption) if the hardware is not present.

->client field in adm1026, adm1031, smsc47b397 and smsc47m1 is the first in
${HWMON}_data structure, but fix them too.

Signed-off-by: default avatarJonathan Corbet <corbet@lwn.net>
Signed-off-by: default avatarAlexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
parent d634cc15

drivers/hwmon/adm1026.c

+1 −1
Original line number Diff line number Diff line
@@ -1691,7 +1691,7 @@ int adm1026_detect(struct i2c_adapter *adapter, int address, 


	/* Error out and cleanup code */

exitfree:

	kfree(new_client);

	kfree(data);

exit:

	return err;

}

drivers/hwmon/adm1031.c

+1 −1
Original line number Diff line number Diff line
@@ -834,7 +834,7 @@ static int adm1031_detect(struct i2c_adapter *adapter, int address, int kind) 
	return 0;



exit_free:

	kfree(new_client);

	kfree(data);

exit:

	return err;

}

drivers/hwmon/adm9240.c

+1 −1
Original line number Diff line number Diff line
@@ -616,7 +616,7 @@ static int adm9240_detect(struct i2c_adapter *adapter, int address, int kind) 


	return 0;

exit_free:

	kfree(new_client);

	kfree(data);

exit:

	return err;

}

drivers/hwmon/smsc47b397.c

+1 −1
Original line number Diff line number Diff line
@@ -298,7 +298,7 @@ static int smsc47b397_detect(struct i2c_adapter *adapter, int addr, int kind) 
	return 0;



error_free:

	kfree(new_client);

	kfree(data);

error_release:

	release_region(addr, SMSC_EXTENT);

	return err;

drivers/hwmon/smsc47m1.c

+1 −1
Original line number Diff line number Diff line
@@ -495,7 +495,7 @@ static int smsc47m1_detect(struct i2c_adapter *adapter, int address, int kind) 
	return 0;



error_free:

	kfree(new_client);

	kfree(data);

error_release:

	release_region(address, SMSC_EXTENT);

	return err;

CRA Git | Maintained and supported by SUSTech CRA and CCSE